Cyber Incident Exercising
Our cyber incident exercising service helps develop your organisation’s muscle memory in response to potential threats in realistic threat scenarios.
What is a Cyber Incident Exercising?
Cyber incident exercising is the process of practising cyber response techniques against potential threats in a safe and simulated environment.
The purpose of cyber incident exercising is to prepare cyber security teams for real threat scenarios, where response time is critical.
Its tactics and techniques can be used to establish current organisational practices and formulate an incident response plan (IRP) - or to evaluate the effectiveness of an existing IRP.
The Importance of Cyber Incident Exercising
Our cyber incident exercise service is recommended for any organisation looking to upskill and optimise their cyber security team’s ability and preparedness to handle the latest threats.
In the unfortunate event of a breach, well-practised teams can communicate, respond and remediate the threat effectively to minimise the impact. Several key benefits include:
- Cross-team Coordination: Bridewell’s cyber incident exercising service incorporates multiple departments, from IT to legal and communications. During incident response situations, your teams will gain necessary insight into each role and work collaboratively.
- Realistic Scenarios: Roleplaying scenarios suggested by our cyber incident exercising team are based on threats your organisation faces, updated with current industry trends. This is done to provide a realistic environment in which to pressure test your team.
- Identify Gaps in Security: With Bridewell’s cyber incident exercising service, you’ll be able to review team performance in simulations, so you can spot and amend any gaps in team coordination.
What to Expect from Cyber Incident Exercising with Bridewell
Our cyber incident exercising service is designed to prepare your organisation for an effective response against cyber attacks.
It replicates the realistic scenarios your organisation might face. So, key staff know their roles and responsibilities when a live incident occurs. This means less time speculating and more time responding in the face of a real attack.
The key components of our cyber incident exercising service include:
Realistic Simulations
Cyber incident exercising offers tailored simulations that imitate a real cyber attack. This is based on risks, vulnerabilities, and industry threats, to make the simulation highly relevant to a specific organisation. These attacks can range from ransomware to data breaches or insider threats. The aim is to challenge your organisation’s response capabilities and pressure test your team to identify gaps in your remediation process.
Team Involvement
Bridewell’s cyber incident exercising service incorporates members from various departments, including IT, security, communications and legal. This helps ensure that everyone within your organisation is coordinated in its approach to cyber threats.
Cyber Live Play Exercises
Bridewell’s Live Play exercises emulate an adversary incident as a trigger event - adding realism that goes beyond the boardroom table. Technical Live Play is based on your organisation’s threat landscape and uses MITRE ATT&CK tactics and techniques to develop incident escalation. Executive Live Play focuses on senior decision-making, leadership response and communication in the event of a live attack.
Tactical Guidance
Bridewell’s cyber security experts provide tactical guidance in real-time, offering advice and helping teams understand best practices and improve response strategies.
Debrief and Improvement Plans
Our team of experts will provide a debrief and feedback post-simulation to help break down gaps in team performance and provide actionable plans for improvements going forward.
Learn more about our Incident Response Services
If you require a cyber incident exercising service, speak with one of our team to see how we can support.
Manchester Airport Group Revolutionises Its Level of Visibility and Protection With SOC Transformation
Finding the Right Partner
Setting up the outsourced SOC had previously been a gruelling project and the thought of taking on another project of this scale was daunting for MAG, especially in terms of the time it would take. The company recognised it needed support and sought advice from peers across the UK aviation sector. Following conversations, Tony Johnson, Head of Cyber Security Operations at MAG, was invited to a conference at a leading UK airport that had undergone a similar transformation and migration. It was here that he learned about the airport’s own journey building a more modern, agile outsourced SOC with Bridewell as its security partner. The peer airport had moved away from a fully outsourced SOC and worked with Bridewell to deploy a new SOC technology stack which is a blend of Microsoft Sentinel and Microsoft Defender XDR. Johnson was impressed by how much was done in such a short amount of time, including onboarding new services. “The team spoke highly of Bridewell,” said Johnson. “Bridewell represented themselves very well when we met them there. We had a really productive conversation and could have easily mistaken them for our peers own in-house security team as they had so much knowledge of the business and its infrastructure.”
Getting the Project off the Ground
The progress that had been made at the peer airport and the strong relationship between the airport operator and Bridewell put Johnson’s fears to rest concerning the scale of the MAG project. Using the model Bridewell had developed with the Microsoft Defender XDR and Microsoft Azure Sentinel stacks, Johnson got to work on the business case for the new SOC.
He engaged Microsoft to develop a pilot SOC solution, funded by Microsoft, however, they too stressed the importance of having the right cyber security partner involved. Johnson already had Bridewell in mind.
“We had the technical capabilities to do this on our own, but we wanted to work with a company that had been there and done that. We knew that Bridewell had the relevant experience in aviation as well as ASSURE accreditation so could avoid the pitfalls and complications which can arise in this sector,” said Johnson.
Because of the previous experience outsourcing their SOC, MAG wanted to change its delivery model from a fully outsourced setup to a hybrid approach that would enable more autonomy over its protection. It wanted to keep some capabilities in-house in order to benefit from the understanding of the business and context the in-house team brings, while leveraging Bridewell’s expertise to design, implement and operate its security infrastructure, as well as train internal teams.
A two-tiered solution was agreed, keeping some security operations in-house while Bridewell ran the company’s 24/7 monitoring facilities. This enabled MAG to benefit from a state-of-the-art security without having to build their own entire security operation.
Once Bridewell understood MAG’s business objectives, an assessment phase took place in which Bridewell performed a gap analysis, followed by a design phase where it looked at the resources already available within MAG and highlighted any additional resource, technology and processes required to make the transition a success. With a significant percentage of MAG’s staff furloughed due to the pandemic, resource was a challenge. However, Bridewell was able to fill any gaps and keep the project running smoothly and, crucially, on-schedule.
A Resounding Success
Phase two was completed in March 2021 and Bridewell’s SOC analyst and hybrid team has been in place ever since helping the MAG team move forward and providing expert guidance to instil the in-house team with confidence in running the SOC.
Enhanced Visibility and Protection
Thanks to MAG’s partnership with Bridewell and Microsoft, the airport group has seen a major improvement in its security setup across the organisation. The group now has better application security and visibility, including a greater view of its security infrastructure, enabling the team to respond to threats across the kill chain in minutes.
Prior to working with Bridewell, MAG only had 70% visibility of its estate and could only see 5,000 events per second. Since the transition, MAG now has visibility of 80,000 events per second and over 95% of endpoints and servers are visible to the SOC. MAG’s team were also flooded with a lot of unnecessary noise from the incumbent provider which would constantly notify them of potential issues detected. It would be down to the MAG team to investigate the issues which often turned out to be normal behaviour and required no action.
“We’re very confident that we’re delivering a better service internally than the incumbent provider ever could. We can see the outcomes. We can see the incidents that are getting raised and that we’re solving,” said Johnson.
MAG has seen the biggest impact in dealing with phishing attacks. Like many organisations, MAG has experienced a significant increase in phishing attacks over the last 12 months with attackers continually trying new approaches to trick employees into opening malicious links. The previous solution would entail a lengthy manual process that required MAG to contact other internal technical teams to undertake tasks every time a phishing attempt was reported. However, the new SOC automatically spots phishing attempts, checks that nobody in the organisation has clicked the links, and removes threat from inboxes across the organisation.
The organisation had also been considering a SOC assurance audit from a third party to demonstrate the strength of the new solution, but initial conversations with assurance providers revealed this would be costly and time consuming. And with the positive impact of the new Bridewell solution so clear, senior stakeholder within MAG deemed that an assurance audit was not necessary.
Industry
Cyber Incident Exercising FAQs
Incident response exercising should be conducted regularly, for example annually or biannually, depending on your risk profile and requirements. It should also be undertaken when significant updates or changes are made to your cyber security infrastructure. This could be through new staff, systems or identified threats.
Tabletop exercising and live play are both cyber incident tactics designed to assess and develop an organisation’s cyber readiness. But they differ in their approach.
A tabletop exercise, as its name suggests, is based in the boardroom. It involves walking teams through potential scenarios and helping them understand their roles and responsibilities as incidents escalate. This can be valuable in building confidence and understanding in a workshop environment.
Live play goes one step further by simulating a real attack to trigger a cyber incident. The main benefit of live play is the ability to pressure-test individuals in a realistic attack scenario.
Live play and red teaming are both cyber security tactics used to test a team’s ability to effectively respond to threats.
Red teaming aims to test an organisation’s ability to detect and manage attacks by simulating an attempt to hack or compromise the IT environment. It aims to evaluate threat prevention and spot gaps in defences.
Live play is instead focused on testing the organisation’s response once an incident has already occurred. It focuses on response effectiveness – how teams communicate and ultimately remediate a live, escalating incident.
Why Us?
.svg?sfvrsn=428a1942_1){kind=icon}
Awards
Our team have won numerous industry awards, including 'Cyber Security Company of the Year' at the Cyber Security Awards 2026 and Best Cyber Security Service Provider' at the Cyber Security Awards 2025.
Certifications
Our people and services are highly accredited by leading industry bodies including CREST, the NCSC, and more. Our SOC holds extensive accreditations from CREST (including for CSIR and SOC2) and works closely with our cyber consultancy services.
Partnerships
As a Microsoft Partner, we also hold advanced specialisms in Cloud Security and Threat Protection. We’ve also implemented some of the UK’s largest deployments of the Microsoft Security stack, inc. Sentinel, Defender, Purview and more.
