Cyber Incident Exercising
Our cyber incident exercising service helps develop your organisation’s muscle memory in response to potential threats in realistic threat scenarios.
What is a Cyber Incident Exercising?
Cyber incident exercising is the process of practising cyber response techniques against potential threats in a safe and simulated environment.
The purpose of cyber incident exercising is to prepare cyber security teams for real threat scenarios, where response time is critical.
Its tactics and techniques can be used to establish current organisational practices and formulate an incident response plan (IRP) - or to evaluate the effectiveness of an existing IRP.
The Importance of Cyber Incident Exercising
Our cyber incident exercise service is recommended for any organisation looking to upskill and optimise their cyber security team’s ability and preparedness to handle the latest threats.
In the unfortunate event of a breach, well-practised teams can communicate, respond and remediate the threat effectively to minimise the impact. Several key benefits include:
- Cross-team Coordination: Bridewell’s cyber incident exercising service incorporates multiple departments, from IT to legal and communications. During incident response situations, your teams will gain necessary insight into each role and work collaboratively.
- Realistic Scenarios: Roleplaying scenarios suggested by our cyber incident exercising team are based on threats your organisation faces, updated with current industry trends. This is done to provide a realistic environment in which to pressure test your team.
- Identify Gaps in Security: With Bridewell’s cyber incident exercising service, you’ll be able to review team performance in simulations, so you can spot and amend any gaps in team coordination.
What to Expect from Cyber Incident Exercising with Bridewell
Our cyber incident exercising service is designed to prepare your organisation for an effective response against cyber attacks.
It replicates the realistic scenarios your organisation might face. So, key staff know their roles and responsibilities when a live incident occurs. This means less time speculating and more time responding in the face of a real attack.
The key components of our cyber incident exercising service include:
Realistic Simulations
Cyber incident exercising offers tailored simulations that imitate a real cyber attack. This is based on risks, vulnerabilities, and industry threats, to make the simulation highly relevant to a specific organisation. These attacks can range from ransomware to data breaches or insider threats. The aim is to challenge your organisation’s response capabilities and pressure test your team to identify gaps in your remediation process.
Team Involvement
Bridewell’s cyber incident exercising service incorporates members from various departments, including IT, security, communications and legal. This helps ensure that everyone within your organisation is coordinated in its approach to cyber threats.
Cyber Live Play Exercises
Bridewell’s Live Play exercises emulate an adversary incident as a trigger event - adding realism that goes beyond the boardroom table. Technical Live Play is based on your organisation’s threat landscape and uses MITRE ATT&CK tactics and techniques to develop incident escalation. Executive Live Play focuses on senior decision-making, leadership response and communication in the event of a live attack.
Tactical Guidance
Bridewell’s cyber security experts provide tactical guidance in real-time, offering advice and helping teams understand best practices and improve response strategies.
Debrief and Improvement Plans
Our team of experts will provide a debrief and feedback post-simulation to help break down gaps in team performance and provide actionable plans for improvements going forward.
Learn more about our Incident Response Services
If you require a cyber incident exercising service, speak with one of our team to see how we can support.
Recognising the importance of securing their cloud environments, our client was looking to secure their Microsoft 365 environments and services to the highest possible standard, aligning them with best working practices.
The Challenge
Our client required specialist expertise to manage and regularly assess their cloud security posture. Specifically, they were looking for a long-term engagement, with assessments carried out every six months as this would provide them with a repeatable baseline from which they could measure improvements or changes in environment that have led to any security degradation.
The Solution
As part of a long-standing standing Cloud Security Posture Management (CSPM) engagement, our client has been working with Bridewell since 2022. To deliver the CPSM, we provide our client with Cloud Security Posture Assessments (CSPA) every 12 months. These assessments inform them of any potential risks in their cloud platforms, provide a remediation plan to rectify any emergent concerns, and benchmark how their cloud security posture has improved over time.
These assessments also consider the Microsoft licences available to our client as well as the features that are offered within the licences. For both our client’s internal IT team and Bridewell, these assessments have been the foundation of our planning and strategy.
Throughout each assessment period, our consultants access our client’s various administrative portals to check controls and technical security measures are in place. Where controls are not in place, our consultants recommend a suitable mitigation or remediation. The technical controls being assessed are formed from three key areas including: CIS 1 benchmarks, Microsoft Secure Score, and our own curated technical checks aligned to current industry best practice and internal knowledge and experience.
Every six months, at the start of each CSPA, we hold a scoping meeting with our client to define any prerequisites for the assessment. This ensures that we have access to all the required people and systems to conduct the assessment with minimal disruption.
Using these CSPAs, our client has driven, and continues to drive, improvements in the following areas:
Identity and Access Management (IAM) Assessment
Our consultants assess how secure our client’s environment is in terms of users accessing data. The assessment framework we use covers many aspects that also align to Microsoft Secure Score. Therefore, our consultants considered various areas including Privileged Identity Management for administrative users. This assessment extended to assessing how administrators enter the environment as well as checking for a robust Breakglass/ Emergency access process.
Endpoint and Device Security Assessment
We review our client’s use of Microsoft Intune to check that required policies are in place, with emphasis placed on mobile device management.
Email and Phishing Protection Assessment
To ensure that email communication is protected, we assess several features and configurations within the environment including how Conditional Access applies to cloud applications and whether third party integrations are in place.
Data Security and Data Protection Assessment
As part of our CSPM engagement, we assess Data Loss Prevention (DLP) measures. This involves identifying gaps in existing configurations and advising our client accordingly.
Security Monitoring and SIEM Assessment
Our consultants check that logging is appropriate for our client’s budget, and ensure that security benefit is at the forefront of ingestion considerations. Leveraging Microsoft Sentinel’s native data connectors, we provide them with enhanced visibility into their environment. Any misconfigurations or missing configurations are identified and highlighted, with necessary implementations carried out.
Zero Trust and Network Security Assessment
Reflecting our client’s ways of working, our consultants have considered how their employees consume organisational data and services, introducing Conditional Access reviews and an Intune Bring Your Own Policy configuration. Through rigorous scoping, testing and implementation, we’ve ensured that data is accessed securely without hampering the user experience.
The Results
Since 2022, our client’s overall security posture has been significantly strengthened, and they now benefit from the successful implementation and enhancement of key security measures. They now meet best practice with their technical controls and have retooled security policies that reduce administrative overhead.
These improvements to the security of their environment have been reflected in their Microsoft Secure Score.
A UK-based organisation in the hospitality sector.
Industry
Featured Services
Cyber Incident Exercising FAQs
Incident response exercising should be conducted regularly, for example annually or biannually, depending on your risk profile and requirements. It should also be undertaken when significant updates or changes are made to your cyber security infrastructure. This could be through new staff, systems or identified threats.
Tabletop exercising and live play are both cyber incident tactics designed to assess and develop an organisation’s cyber readiness. But they differ in their approach.
A tabletop exercise, as its name suggests, is based in the boardroom. It involves walking teams through potential scenarios and helping them understand their roles and responsibilities as incidents escalate. This can be valuable in building confidence and understanding in a workshop environment.
Live play goes one step further by simulating a real attack to trigger a cyber incident. The main benefit of live play is the ability to pressure-test individuals in a realistic attack scenario.
Live play and red teaming are both cyber security tactics used to test a team’s ability to effectively respond to threats.
Red teaming aims to test an organisation’s ability to detect and manage attacks by simulating an attempt to hack or compromise the IT environment. It aims to evaluate threat prevention and spot gaps in defences.
Live play is instead focused on testing the organisation’s response once an incident has already occurred. It focuses on response effectiveness – how teams communicate and ultimately remediate a live, escalating incident.
Why Us?
.svg?sfvrsn=428a1942_1){kind=icon}
Awards
Our team have won numerous industry awards, including 'Cyber Security Company of the Year' at the Cyber Security Awards 2026 and Best Cyber Security Service Provider' at the Cyber Security Awards 2025.
Certifications
Our people and services are highly accredited by leading industry bodies including CREST, the NCSC, and more. Our SOC holds extensive accreditations from CREST (including for CSIR and SOC2) and works closely with our cyber consultancy services.
Partnerships
As a Microsoft Partner, we also hold advanced specialisms in Cloud Security and Threat Protection. We’ve also implemented some of the UK’s largest deployments of the Microsoft Security stack, inc. Sentinel, Defender, Purview and more.
