Cyber Simulations
A cyber simulation is a live, controlled rehearsal of a cyber incident requiring participants to perform realistic response activities using real tools, channels and processes.
Discuss Your SimulationWhat is a Cyber Simulation?
A cyber simulation is a live, controlled rehearsal of a cyber incident that requires teams to perform real tasks using actual tools and channels.
Unlike tabletop exercises, which are primarily discussion-based, simulations demand action, coordination and decision-making under realistic time pressure.
From Discussion-Led Exercises to Cyber Simulations
Discussion-Led Cyber Crisis Exercise
Discussion-led
Explore decisions and expected actions
Examine plans, roles and assumptions
Facilitated scenario discussion
Builds and explores capability
Cyber Simulation
Action-led
Complete chair assigned actions
Validate procedures and capabilities
More realistic operating conditions
Validate cross-team capability
Designed Around Your Organisation
Every cyber simulation is collaboratively developed around agreed objectives, relevant threats, response arrangements, participants and the organisation’s operating environment. The scenario, delivery channels and expected actions are selected to test the capabilities that matter most to your organisation.
- Agreed objectives and priority capabilities.
- Relevant threats, including cyber, operational, third-party and AI-related incident scenarios.
- Existing plans, governance and escalation arrangements.
- Participants, stakeholders and third-party dependencies.
- Realistic communication channels and expected actions.
The Cyber Simulation Journey
Discovery
Review plans, objectives, communication channels, structures and team composition.
Design
Develop a realistic scenario and determine which actions should be rehearsed.
Simulation
Deliver the live simulation using realistic injects, communications and stakeholder interactions.
Improvement
Facilitate the debrief, produce the After Action Report and prioritise capability improvements.
Why Run a Cyber Simulation?
Test Practical Execution, Not Just Discussion
Validate whether teams can carry out critical response activities effectively, rather than just discussing what they would do.
Validate Escalation and Decision-Making
Test how incidents, information and significant decisions move through technical, operational and executive response structures.
Improve Coordination and Communications
Evaluate how teams share information, manage dependencies, coordinate activities and communicate during a fast-moving cyber incident.
Generate Evidence-Based Improvements
Identify strengths, expose gaps and produce practical recommendations supported by observed performance during the simulation.
What Our Clients Are Saying
“Realistic scenario”
We were very impressed with how Red Goat engaged with our InfoSec department, drafting up a realistic scenario that included a few twist and turns to keep the response team on their toes.
Everyone engaged well with the exercise and whilst great fun, some very valuable lessons were learned.
Geoff Forsyth CISO
PCI Pal
“Extremely Helpful”
“Red Goat Cyber Security were extremely helpful and professional. Their knowledge of cyber security and table top exercising was excellent and provided a real stimulus in preparing for a potential cyber-attack. We would highly recommend them to other maritime and logistic companies”
David Brown OBE, Chief Executive
Bristol Port Company
“Highly Recommend”
“I was delighted with how Red Goat Cyber Security delivered the cyber security table top exercise. We had a wide ranging participation group and they were able to guide and advise as well as ensuring engagement throughout the exercise. It provoked a lot of thought and group discussion. We have learnt valuable lessons to further improve our plans, processes and check lists and would highly recommend them to other organisations”
Andrew Cowling, Director of Informatics at
Salisbury NHS Foundation Trust
Building Realism into Your Simulation
Information reaches the team through realistic channels.
Simulated regulator notification and communication.
Simulated social media and news outlet reports.
Incomplete and conflicting information presented to the team.
Time pressure and competing priorities.
Team actions carried out using real channels and processes.
What Can Be Simulated?
Incident Activation and Escalation
Test mobilisation, notification, activation criteria and escalation through the response structure.
Leadership and Decision-Making
Test authority, prioritisation, governance and significant decisions under pressure.
Team Response Coordination
Test how technical, operational and leadership teams coordinate activities and dependencies.
Internal and External Communications
Test briefings, updates, communication cadence and consistency of messaging to internal and external stakeholders.
AI and Emerging Technology Risks
Test decision-making, communications and response playbooks relating to AI agents, AI governance failures, data leakage, model misuse or other emerging technology scenarios.
Third-Party Risk and Engagement
Test engagement with suppliers, advisers, insurers, regulators and other relevant external parties.
Included in Your Cyber Simulation
Planning and stakeholder consultation.
Bespoke scenario and simulation development.
Facilitated simulation delivery.
Facilitated debrief.
After Action Report.
Prioritised recommendations.
Case Study
Travelex
“We are a global foreign exchange business and were looking for an external firm to design and deliver a cyber crisis simulation to our executives.
After speaking to several providers who didn’t fill us with confidence, Red Goat was recommended by an industry contact and from the first conversation and throughout the engagement, we were very impressed. Lisa and team demonstrated deep insight on cyber incidents and impact, and we worked together to transfer understanding of our business in order to design a highly effective set of simulation injects. Our executives were fully engaged through the exercise and we gained tremendous value in exploring potential issues and challenges which has driven improvements to our security posture and resiliency.
It was a pleasure working with Red Goat and we would recommend them to others.”
James Baker, Senior Cyber Services Manager
Travelex
Cyber Simulation FAQs
A cyber simulation is a live, controlled rehearsal of a cyber incident that requires your team to perform realistic actions using agreed processes, tools and communication channels.
A tabletop exercise is primarily discussion-led. Participants explore a scenario, discuss decisions and review plans. A cyber simulation adds action, requiring participants to perform selected response activities under realistic conditions and time pressure.
The right format depends on your objectives, teams, available time and current level of maturity. Discussion-led exercises help explore and develop capability, while simulations provide greater realism and validation of selected response activities.
Not always. Organisations with established plans, defined roles and previous exercising experience may be ready for simulation activity immediately. The most appropriate approach depends on what you need to test, validate or improve.
Yes. Simulations can be designed around AI-specific scenarios such as governance failures, AI agent misuse, data leakage, compromised AI workflows or other emerging technology risks. As with any Red Goat simulation, the objectives and activities are tailored to the organisation’s operating environment.
Participants typically include crisis management teams, incident response leaders, IT, communications, legal, operations, risk and senior decision-makers. The final attendee list should reflect the objectives of the simulation.
When the team are stood up they will receive information and need to assess impacts, make decisions, communicate with stakeholders, coordinate response activities,log decisions and perform selected actions as the incident develops.
No. Red Goat simulations do not require access to live or production systems. The scope, boundaries, communication channels and permitted activities are agreed during planning so the simulation remains controlled and does not disrupt normal operations.
Duration depends on the objectives, complexity, participants and activities being tested. Red Goat simulations can range from focused half-day sessions to full-day engagements, depending on the agreed scope.
Every simulation is designed around your organisation’s objectives, risks, plans, stakeholders and operating environment. Realism is created through relevant scenarios, realistic communications, evolving information and activities aligned to your response arrangements.
Depending on the scope, outputs will include a facilitated debrief, documented observations, an After Action Report and prioritised recommendations. Readiness is assessed against the agreed objectives and the decisions, communications, coordination and response activities observed during the simulation. For a more detailed readiness assessment we can provide a maturity assessment in addition to the simulation report.
Get in touch to discuss how we can help you achieve your security awareness or resilience goals.
By submitting your message and your phone number and/or email address, you are permitting us to contact you by these means in response to your enquiry or feedback. You also acknowledge that you have read our privacy terms and that you consent to our processing data in accordance with them.
Read our privacy policy here.