Cyber Incident Exercising
Our cyber incident exercising service helps develop your organisation’s muscle memory in response to potential threats in realistic threat scenarios.
What is a Cyber Incident Exercising?
Cyber incident exercising is the process of practising cyber response techniques against potential threats in a safe and simulated environment.
The purpose of cyber incident exercising is to prepare cyber security teams for real threat scenarios, where response time is critical.
Its tactics and techniques can be used to establish current organisational practices and formulate an incident response plan (IRP) - or to evaluate the effectiveness of an existing IRP.
The Importance of Cyber Incident Exercising
Our cyber incident exercise service is recommended for any organisation looking to upskill and optimise their cyber security team’s ability and preparedness to handle the latest threats.
In the unfortunate event of a breach, well-practised teams can communicate, respond and remediate the threat effectively to minimise the impact. Several key benefits include:
- Cross-team Coordination: Bridewell’s cyber incident exercising service incorporates multiple departments, from IT to legal and communications. During incident response situations, your teams will gain necessary insight into each role and work collaboratively.
- Realistic Scenarios: Roleplaying scenarios suggested by our cyber incident exercising team are based on threats your organisation faces, updated with current industry trends. This is done to provide a realistic environment in which to pressure test your team.
- Identify Gaps in Security: With Bridewell’s cyber incident exercising service, you’ll be able to review team performance in simulations, so you can spot and amend any gaps in team coordination.
What to Expect from Cyber Incident Exercising with Bridewell
Our cyber incident exercising service is designed to prepare your organisation for an effective response against cyber attacks.
It replicates the realistic scenarios your organisation might face. So, key staff know their roles and responsibilities when a live incident occurs. This means less time speculating and more time responding in the face of a real attack.
The key components of our cyber incident exercising service include:
Realistic Simulations
Cyber incident exercising offers tailored simulations that imitate a real cyber attack. This is based on risks, vulnerabilities, and industry threats, to make the simulation highly relevant to a specific organisation. These attacks can range from ransomware to data breaches or insider threats. The aim is to challenge your organisation’s response capabilities and pressure test your team to identify gaps in your remediation process.
Team Involvement
Bridewell’s cyber incident exercising service incorporates members from various departments, including IT, security, communications and legal. This helps ensure that everyone within your organisation is coordinated in its approach to cyber threats.
Cyber Live Play Exercises
Bridewell’s Live Play exercises emulate an adversary incident as a trigger event - adding realism that goes beyond the boardroom table. Technical Live Play is based on your organisation’s threat landscape and uses MITRE ATT&CK tactics and techniques to develop incident escalation. Executive Live Play focuses on senior decision-making, leadership response and communication in the event of a live attack.
Tactical Guidance
Bridewell’s cyber security experts provide tactical guidance in real-time, offering advice and helping teams understand best practices and improve response strategies.
Debrief and Improvement Plans
Our team of experts will provide a debrief and feedback post-simulation to help break down gaps in team performance and provide actionable plans for improvements going forward.
Learn more about our Incident Response Services
If you require a cyber incident exercising service, speak with one of our team to see how we can support.
Bridewell Supports WLGA With Wales-Wide CAF Assessment Programme to Strengthen Cyber Security Maturity
The Challenge
In 2025, the WLGA were tasked with co-ordinating the implementation the NCSC’s Cyber Assessment Framework (CAF) across Welsh local government, contributing to a Wales-wide approach to assessing cyber security under the “Defend as one” ethos. While they understood that the CAF provides a structured approach to enable this, it would require significant coordination, training, and subject-matter expertise.
“We knew that to deliver a project of this scale we would need specialised cyber support, not only to give us the technical knowledge but to also help drive the cultural change in local government that the CAF seeks to provide. After going to market and reviewing our options, Bridewell’s experience with working with local government in England and their large catalogue of specialised services made them the clear choice”
- Designing and delivering CAF training workshops for local government organisations
- Delivering documentation and training materials to support WLGA and local government organisations in completing CAF self-assessments
- Providing an independent review of the CAF self-assessments provided by local government organisations, including reviewing the evidence provided against Indicators of Good Practice (IGPs)
The Solution
- Delivering a Wales-wide landscape snapshot of cyber security maturity, establishing a baseline for ongoing improvement.
- Providing subject-matter expert support through training, quality review, and feedback
- Our team held multiple training sessions for local authorities covering: the purpose and structure of the CAF, CAF objectives, expected submission content, standard responses, tailored examples, and evidence requirements.
- Bridewell also delivered ‘CAF Surgeries’. These were in-person sessions where our team travelled across Wales to meet with local authorities and fire and rescue services to provide tailored support for their CAF assessments, help identify critical systems and review system architecture diagrams.
- Creating sustainable infrastructure (training materials, workbook templates, dashboard, knowledge repository) for ongoing CAF cycles
- This included a library of short videos explaining each of the contributing outcomes within the CAF and what evidence is required for each.
- All assets were made available in a centralised repository for easy access by local authorities.
- Establishing a programme that builds trust and encourages genuine engagement rather than a purely compliance-led approach.
Given the scale of the project, the requirements of the WLGA and participating organisations evolved quickly, requiring the Bridewell team to remain agile throughout delivery. The programme also required extensive planning and coordination, including regular planning sessions, monthly check-ins, and weekly interactions with individual teams to escalate issues and risks where needed
The Results
Through this programme of work, the WLGA has established a clearer view of cyber security maturity across participating organisations, including common gaps, areas for improvement, and opportunities to better support councils in aligning with the CAF. This was reflected in measurable improvements across the programme, with the 25 participating Welsh public sector organisations showing notable improvements to quality and completeness in CAF objectives as the programme progressed
- CAF Self-Assessment Workbook Template – A WLGA-adapted version of the NCSC CAF workbook for Welsh local government, with updated formatting for clarity, grouping of IGPs where applicable, and worked examples.
- Critical System Mapping Workbook – Architecture mapping workbook template for councils to document critical system components, dependencies, boundaries, and architecture maps. This includes a breakdown of dedicated and shared components.
- CAF Training Materials and Workshop Packs – A comprehensive training package including virtual session materials, in-person CAF Surgery workshop content, and FAQs.
- Bridewell Quality Review and Feedback Packs – Independent quality assessments of each submission scored across five dimensions (Completeness, Accuracy, Clarity, Evidence, Relevance) with confidential feedback provided to each organisation.
Wales CAF Landscape Baseline Snapshot – First Wales-wide snapshot of CAF positions across all 25 participating organisations, establishing the baseline for ongoing maturity tracking.
“The programme is starting to show tangible benefits for the collective cyber resilience of Welsh local government. As cyber threats continue to evolve, the CAF programme has provided Welsh local government with a common framework, shared language and evidence-based approach to strengthening cyber resilience. The foundations established through this work will support future CAF cycles and help organisations continue improving their cyber security maturity over time.
The work Bridewell has done to support this has been invaluable, their breadth of knowledge and experience has allowed us to give effective support and assured feedback to our local government partners to help their CAF assessments mature. Their pragmatic and considered approach to planning and programme management has also meant that close working relationships have been developed, allowing for open and honest conversation about the work have to do, and the best way to do it.”
A politically balanced, cross-party and member-led organisation
Industry
Featured Services
Cyber Incident Exercising FAQs
Incident response exercising should be conducted regularly, for example annually or biannually, depending on your risk profile and requirements. It should also be undertaken when significant updates or changes are made to your cyber security infrastructure. This could be through new staff, systems or identified threats.
Tabletop exercising and live play are both cyber incident tactics designed to assess and develop an organisation’s cyber readiness. But they differ in their approach.
A tabletop exercise, as its name suggests, is based in the boardroom. It involves walking teams through potential scenarios and helping them understand their roles and responsibilities as incidents escalate. This can be valuable in building confidence and understanding in a workshop environment.
Live play goes one step further by simulating a real attack to trigger a cyber incident. The main benefit of live play is the ability to pressure-test individuals in a realistic attack scenario.
Live play and red teaming are both cyber security tactics used to test a team’s ability to effectively respond to threats.
Red teaming aims to test an organisation’s ability to detect and manage attacks by simulating an attempt to hack or compromise the IT environment. It aims to evaluate threat prevention and spot gaps in defences.
Live play is instead focused on testing the organisation’s response once an incident has already occurred. It focuses on response effectiveness – how teams communicate and ultimately remediate a live, escalating incident.
Why Us?
.svg?sfvrsn=428a1942_1){kind=icon}
Awards
Our team have won numerous industry awards, including 'Cyber Security Company of the Year' at the Cyber Security Awards 2026 and Best Cyber Security Service Provider' at the Cyber Security Awards 2025.
Certifications
Our people and services are highly accredited by leading industry bodies including CREST, the NCSC, and more. Our SOC holds extensive accreditations from CREST (including for CSIR and SOC2) and works closely with our cyber consultancy services.
Partnerships
As a Microsoft Partner, we also hold advanced specialisms in Cloud Security and Threat Protection. We’ve also implemented some of the UK’s largest deployments of the Microsoft Security stack, inc. Sentinel, Defender, Purview and more.
