Cyber Incident Exercising
Our cyber incident exercising service helps develop your organisation’s muscle memory in response to potential threats in realistic threat scenarios.
What is a Cyber Incident Exercising?
Cyber incident exercising is the process of practising cyber response techniques against potential threats in a safe and simulated environment.
The purpose of cyber incident exercising is to prepare cyber security teams for real threat scenarios, where response time is critical.
Its tactics and techniques can be used to establish current organisational practices and formulate an incident response plan (IRP) - or to evaluate the effectiveness of an existing IRP.
The Importance of Cyber Incident Exercising
Our cyber incident exercise service is recommended for any organisation looking to upskill and optimise their cyber security team’s ability and preparedness to handle the latest threats.
In the unfortunate event of a breach, well-practised teams can communicate, respond and remediate the threat effectively to minimise the impact. Several key benefits include:
- Cross-team Coordination: Bridewell’s cyber incident exercising service incorporates multiple departments, from IT to legal and communications. During incident response situations, your teams will gain necessary insight into each role and work collaboratively.
- Realistic Scenarios: Roleplaying scenarios suggested by our cyber incident exercising team are based on threats your organisation faces, updated with current industry trends. This is done to provide a realistic environment in which to pressure test your team.
- Identify Gaps in Security: With Bridewell’s cyber incident exercising service, you’ll be able to review team performance in simulations, so you can spot and amend any gaps in team coordination.
What to Expect from Cyber Incident Exercising with Bridewell
Our cyber incident exercising service is designed to prepare your organisation for an effective response against cyber attacks.
It replicates the realistic scenarios your organisation might face. So, key staff know their roles and responsibilities when a live incident occurs. This means less time speculating and more time responding in the face of a real attack.
The key components of our cyber incident exercising service include:
Realistic Simulations
Cyber incident exercising offers tailored simulations that imitate a real cyber attack. This is based on risks, vulnerabilities, and industry threats, to make the simulation highly relevant to a specific organisation. These attacks can range from ransomware to data breaches or insider threats. The aim is to challenge your organisation’s response capabilities and pressure test your team to identify gaps in your remediation process.
Team Involvement
Bridewell’s cyber incident exercising service incorporates members from various departments, including IT, security, communications and legal. This helps ensure that everyone within your organisation is coordinated in its approach to cyber threats.
Cyber Live Play Exercises
Bridewell’s Live Play exercises emulate an adversary incident as a trigger event - adding realism that goes beyond the boardroom table. Technical Live Play is based on your organisation’s threat landscape and uses MITRE ATT&CK tactics and techniques to develop incident escalation. Executive Live Play focuses on senior decision-making, leadership response and communication in the event of a live attack.
Tactical Guidance
Bridewell’s cyber security experts provide tactical guidance in real-time, offering advice and helping teams understand best practices and improve response strategies.
Debrief and Improvement Plans
Our team of experts will provide a debrief and feedback post-simulation to help break down gaps in team performance and provide actionable plans for improvements going forward.
Learn more about our Incident Response Services
If you require a cyber incident exercising service, speak with one of our team to see how we can support.
Case Study: Gwent Police
To overcome this, some bodies in South Wales have chosen to amalgamate their IT support services, which is being delivered by the Shared Resource Services Wales (SRS). As a result, Gwent Police, Monmouthshire County Borough Council, Torfaen County Borough Council and Blaenau Gwent County Borough Council all have their IT support services managed by the SRS. The SRS is a collaborative technology provision, underpinned by a Memorandum of Understanding that enables the groups to have a single management structure across the board. The model is one that is now heavily encouraged through the Welsh Public Sector Technology Strategy. The SRS has a host employer for all SRS staff, a single mechanism for managing the entire delegated budget, a single plan of audit and a single governance structure, which includes cyber and information security.
For Nigel Stephens, Assistant Chief Officer of Resources who is responsible for the cyber and information security service, this style of arrangement meant managing the requirements of not only of Gwent Police, but also those of each council, who also have their own edicated Senior Information Risk Owners.
Initially there was a significant struggle around resourcing the cyber and information security unction, since attracting the right calibre of individuals at the right price in the industry is challenging.
This could quickly impact the cyber and information security operations of each organisation leaving them struggling to cope. Rather than leave it to chance, the organisations sought the support of an external cyber and information security company who also had industry experience of public sector, their risk profiles and compliance requirements.
Challenging Threat & Compliance Landscape
Each organisation has their own compliance requirements, which needed to be delivered
by the central cyber and information security function that Nigel is responsible for. This included ISO27001:2013 certification, four annual PSN compliance audits, one PSNP compliance requirement and three PCI DSS compliance processes. There were also a umber of technical security requirements that needed to be delivered, along with re-establishing governance frameworks to manage and report on cyber and information security operations.
In Nigel’s view he states that;
“Gwent Police had lost our information team and a lot of our security team, so we needed to ensure that we got a provision in quickly. We initially conducted a procurement process via G-Cloud and subsequently went out to formal tender and Bridewell were successful”.
“Bridewell now provide a fully outsourced cyber and information security service to Gwent Police and three other partner organisations. They are also helping us with the new PSN requirements for policing, and supporting our local partners who have very similar requirements”.
One Step At A Time
Because the requirements of Gwent Police were so complex and specific, Bridewell provided one of their expert CESG Certified Professional consultants to work on-site with not only the director of the police, but the senior leadership across all involved councils and organisations.
By working with all of these bodies, Bridewell were able to ensure that their ISO27001:2013 certification was retained. As well as delivered a number of strategic technical improvements that drastically reduced the Police and Councils attack surface and created an improved set of policies, procedures and processes, all within the first year.
Once the initial issues were handled, Bridewell continue to provide the service, driving security improvements across all platforms in collaboration with the SRS, which range from compliance improvements, security operations and penetration testing.
“With a range of different skills and expertise within the IT security world needed, we got the flexibility wrapped around that with Bridewell. They offer a professional, responsive security service and they do provide a range of other services specifically around other security areas required, which proves cost effective and I think that for me is the nub of it, they know what they’re doing, they do a good job and we’re not paying through the nose.”
But it wasn’t all smooth sailing. SRS operate and deliver services using an Agile based delivery method, which whilst working well, wasn’t initially integrating with information security, so it was difficult to track and manage the work being performed for security and maintenance activities, such as patching.
However, the team at Bridewell worked closely with the SRS to get security activities integrated into the Agile Sprints and developed a weekly reporting system, which provided the directors with all the information they needed on progress against key activity that has been commissioned.
Nigel also commented that Bridewell solved a number of challenges for him, including personnel related issues:
“I think it’s significant in that Bridewell solve personnel challenges by providing the complete set of skills required dependant on task and also ensure their knowledge is current and up to date, as well as having the capacity to provide knowledge transfer to many individuals. Bridewell can provide an extensive service in the areas of knowledge and expertise, that is obviously required. We wouldn’t, as individual small organisations, be able to afford the range of expertise provided to effectively deliver all the services required.”
Efficiency Through United Leadership
Of course, operating across a Police Force and 3 Local Authorities isn’t always simple, and many things could easily get lost in translation. To avoid this, and to ensure all parties needs were met, Bridewell created an Information Security Leadership Board, which engages all senior executives within the Police and the Local Authorities. This allowed Bridewell to engage with each organisation on a regular basis to collaborate and manage strategic requirement, driving real cyber and information security improvement.
“Bridewell is delivering Information Security Services, both from a leadership perspective and Technical IT Operations Security, working with the SRS to secure our infrastructure, applications and mobile solutions.
Basically, everything that needs a connection into the PSN for the councils. They provide a full range of services to ensure that we configure and operate the technology in accordance with NCSC guidance and good practice.”
Nigel added that this level of support had been particularly invaluable for him:
“All four organisations are involved in information security services and actually collaborate on many things, which allows all of our IT to be delivered from a single, secure data centre. Bridewell has been able to provide an information security team based from that site, working with the SRS to ensure our security requirements are being delivered”
Protecting The Protectors
While Gwent Police spend their days protecting the people of Gwent, they take advantage of modern technology to support policing and it is critical that this technology is protected from vulnerabilities, malware and hacking attempts.
Through working with Bridewell, Gwent Police have also been able to effectively manage this responsibility; providing timely identification, advice and guidance to mitigate some of the well-known industry threats and vulnerabilities that have emerged, such as WannaCry, Petya and more recently the Krack vulnerability.
“Naturally, we do face hacking attempts, and we are very much aware of our vulnerabilities. Bridewell ensures that when any one of the partner defence systems is attacked, that we’ve got coverage across all four of the partner organisations” During the course of all these industry scares the Police and Local Authorities have managed to deal with them effectively, working collaboratively with the SRS.
“Bridewell report very clearly, so I get a weekly report on the progress that they have made for all four partners as I manage the contract. They support and drive security leadership meetings, which I chair on behalf of the four partners and are clear on progress and how the support program is working”.
“Overall, Bridewell have been worth their weight in gold, I am impressed with their philosophy and approach; and in all seriousness, the relative amounts that each individual partner pays towards the service means it offers very good value for money.”
Bridewell have a vast amount of services within their Portfolio, covering Cyber Security, Technology Risk, Information Security and Assurance, Penetration Testing and Data Privacy. To discuss how Bridewell could assist your organisation with your requirements just get in touch with us today.
Cyber Incident Exercising FAQs
Incident response exercising should be conducted regularly, for example annually or biannually, depending on your risk profile and requirements. It should also be undertaken when significant updates or changes are made to your cyber security infrastructure. This could be through new staff, systems or identified threats.
Tabletop exercising and live play are both cyber incident tactics designed to assess and develop an organisation’s cyber readiness. But they differ in their approach.
A tabletop exercise, as its name suggests, is based in the boardroom. It involves walking teams through potential scenarios and helping them understand their roles and responsibilities as incidents escalate. This can be valuable in building confidence and understanding in a workshop environment.
Live play goes one step further by simulating a real attack to trigger a cyber incident. The main benefit of live play is the ability to pressure-test individuals in a realistic attack scenario.
Live play and red teaming are both cyber security tactics used to test a team’s ability to effectively respond to threats.
Red teaming aims to test an organisation’s ability to detect and manage attacks by simulating an attempt to hack or compromise the IT environment. It aims to evaluate threat prevention and spot gaps in defences.
Live play is instead focused on testing the organisation’s response once an incident has already occurred. It focuses on response effectiveness – how teams communicate and ultimately remediate a live, escalating incident.
Why Us?
.svg?sfvrsn=428a1942_1){kind=icon}
Awards
Our team have won numerous industry awards, including 'Cyber Security Company of the Year' at the Cyber Security Awards 2026 and Best Cyber Security Service Provider' at the Cyber Security Awards 2025.
Certifications
Our people and services are highly accredited by leading industry bodies including CREST, the NCSC, and more. Our SOC holds extensive accreditations from CREST (including for CSIR and SOC2) and works closely with our cyber consultancy services.
Partnerships
As a Microsoft Partner, we also hold advanced specialisms in Cloud Security and Threat Protection. We’ve also implemented some of the UK’s largest deployments of the Microsoft Security stack, inc. Sentinel, Defender, Purview and more.
