Cyber crisis simulations involving 147 organisations have highlighted weaknesses in technical containment, secure communications and recovery planning, according to new research from business continuity specialist Databarracks.

Its Anatomy of a Crisis wargames analysed 2,117 scored responses from 303 participants, who were placed in scenarios based on real-world cyber attacks, such as incidents affecting M&S, Royal Mail and the British Library.

The findings suggest leaders are more confident in governance and communications than in technical execution. Average scores for governance and communication decisions were 17 points higher than those for technical execution, including containing attacks while maintaining essential services and recovering systems safely.

Although 66% of responses to a containment scenario recommended isolating affected systems, only 7% explained how decisions to shut down or maintain services should be prioritised. Just 20% mentioned preserving forensic visibility before wiping or rebuilding systems.

Secure crisis communications were another weakness. Only 11% of responses explicitly recommended assuming corporate systems had been compromised and switching to clean communication channels, while 8% mentioned verifying identities before trusting instructions.
The exercises found that participants generally considered a broad range of business priorities during prolonged disruption, including customers, employees, suppliers, regulatory obligations and cash flow. However, Databarracks warn that organisations also need to test manual workarounds and ensure they can be sustained safely during extended outages.

Chris Butler, resilience director at Databarracks, said: “Resilience needs to be built across the crisis team before an attack occurs. Without rehearsal, preparation falls flat.

“No single professional perspective consistently covered every part of the crisis. Instead, the strengths were complementary. The strongest elements across the cohort would combine the resilience professional’s command structure, the technologist’s forensic discipline, the risk professional’s prioritisation and the operations team’s focus on customers and safe recovery.

“The finding supports the case for building and exercising cross-functional crisis teams, so those perspectives are available when decisions need to be made.”

---