Cyber Incident Exercising
Our cyber incident exercising service helps develop your organisation’s muscle memory in response to potential threats in realistic threat scenarios.
What is a Cyber Incident Exercising?
Cyber incident exercising is the process of practising cyber response techniques against potential threats in a safe and simulated environment.
The purpose of cyber incident exercising is to prepare cyber security teams for real threat scenarios, where response time is critical.
Its tactics and techniques can be used to establish current organisational practices and formulate an incident response plan (IRP) - or to evaluate the effectiveness of an existing IRP.
The Importance of Cyber Incident Exercising
Our cyber incident exercise service is recommended for any organisation looking to upskill and optimise their cyber security team’s ability and preparedness to handle the latest threats.
In the unfortunate event of a breach, well-practised teams can communicate, respond and remediate the threat effectively to minimise the impact. Several key benefits include:
- Cross-team Coordination: Bridewell’s cyber incident exercising service incorporates multiple departments, from IT to legal and communications. During incident response situations, your teams will gain necessary insight into each role and work collaboratively.
- Realistic Scenarios: Roleplaying scenarios suggested by our cyber incident exercising team are based on threats your organisation faces, updated with current industry trends. This is done to provide a realistic environment in which to pressure test your team.
- Identify Gaps in Security: With Bridewell’s cyber incident exercising service, you’ll be able to review team performance in simulations, so you can spot and amend any gaps in team coordination.
What to Expect from Cyber Incident Exercising with Bridewell
Our cyber incident exercising service is designed to prepare your organisation for an effective response against cyber attacks.
It replicates the realistic scenarios your organisation might face. So, key staff know their roles and responsibilities when a live incident occurs. This means less time speculating and more time responding in the face of a real attack.
The key components of our cyber incident exercising service include:
Realistic Simulations
Cyber incident exercising offers tailored simulations that imitate a real cyber attack. This is based on risks, vulnerabilities, and industry threats, to make the simulation highly relevant to a specific organisation. These attacks can range from ransomware to data breaches or insider threats. The aim is to challenge your organisation’s response capabilities and pressure test your team to identify gaps in your remediation process.
Team Involvement
Bridewell’s cyber incident exercising service incorporates members from various departments, including IT, security, communications and legal. This helps ensure that everyone within your organisation is coordinated in its approach to cyber threats.
Cyber Live Play Exercises
Bridewell’s Live Play exercises emulate an adversary incident as a trigger event - adding realism that goes beyond the boardroom table. Technical Live Play is based on your organisation’s threat landscape and uses MITRE ATT&CK tactics and techniques to develop incident escalation. Executive Live Play focuses on senior decision-making, leadership response and communication in the event of a live attack.
Tactical Guidance
Bridewell’s cyber security experts provide tactical guidance in real-time, offering advice and helping teams understand best practices and improve response strategies.
Debrief and Improvement Plans
Our team of experts will provide a debrief and feedback post-simulation to help break down gaps in team performance and provide actionable plans for improvements going forward.
Learn more about our Incident Response Services
If you require a cyber incident exercising service, speak with one of our team to see how we can support.
Our client is a UK-based water company with a large infrastructure of Industrial Control System (ICS) sites distributed over a wide geographical area. These sites did not have any remote network connectivity to them but could be monitored through a dial-up telemetry system. There were also leased lines in place inter-linking specific water treatment sites. There were several typical ICS architectures in operation, ranging from smaller sites with a simple programmable controller, to large complex sites with multiple controllers and operator interfaces. Some of the complex systems were interconnected with legacy proprietary network protocols, although some used Ethernet local area networks (LANs).
The Challenge
Our client identified a range of business needs for digitising communications to its ICS networks through IP communications, including:
- asset performance monitoring
- remote support
- extraction of valuable OT/ICS data into business systems
- monitoring of internal security threats
- replacement of leased lines
This level of interconnectivity would expose the infrastructure to external threats which it had not previously faced, nor been designed to combat, as some of the equipment had been in service for many years. The increased interconnectivity would also significantly magnify any breach, due to the potential to compromise multiple systems simultaneously.
Our client established an IP enablement program to deliver the required infrastructure to support secure IP communications to its ICS environments. Central to the IP enablement project was a cloud datacentre hosted in Microsoft Azure, which was delivered by Bridewell. It was agreed with the client that the Azure deployment would operate in a dedicated OT tenancy, employing managed subscriptions and resource groups to provide common internal and external gateway infrastructure shared across multiple applications whilst maintaining administrative segregation between resources.
The Solution
Over the course of the two-year program, we designed and delivered the following:
1. High-level design - Covering all areas of the IP enablement solution, including:
- A scalable Azure OT data centre design to allow for easy hosting of additional applications and services in the future.
- A centrally manageable security gateway infrastructure to secure data centre interfaces and remote site borders.
- A VPN solution to protect data across the company’s MPLS WAN providing secure inter-site communications.
- A secure remote access solution that mitigated the risk of a threat using the service to simultaneously impact multiple remote sites.
- Standard segregated network architecture for ICS sites.
- Active Directory for centralised identity and access management.
- Read-only domain controllers on remote sites to provide user authentication and authorisation should connection to the data centre be unavailable.
- Security event collection into SIEM to allow SOC monitoring.
2. Detailed-level designs - After approval of the high-level design, Bridewell developed detailed-level designs for the Azure datacentre (including the VPN infrastructure and secure remote access), Active Directory infrastructure, ICS network security design, and ICS endpoint protection.
3. IP addressing schema - To support the ability to assign unique addresses in a consistent manner whilst providing efficient routing and VPN configuration, we developed an OT infrastructure-wide IP addressing schema scalable for IP enablement of the entire estate.
4. Firewall rule base - To ensure traffic flows were restricted to the minimum necessary at all network borders, we designed the firewall rulesets to be deployed on the data centre and ICS site firewalls.
The Results
Bridewell delivered a fully functional OT data centre in Azure, comprised of:
External network virtual appliances (NVAs) - Providing central breakout to the Internet for the entire OT network.
Internal NVAs - Providing access via three ExpressRoute circuits into a private MPLS wide area network, separating traffic dependent upon business area.
Load balancers - External and internal NVAs were deployed in high-availability pairs with load balancers to direct traffic to the primary active node.
DMZ network - Connected between the external and internal NVAs.
Active Directory - A combination of Windows Server AD (hosted in Azure) and Azure AD with MFA providing group policy management and centralised authentication for the entire OT estate.
IaaS & PaaS - The data centre used PaaS resources where available, such as SQL server databases. However, most OT applications had no PaaS service offerings, requiring the deployment of virtual machines (VM)s to host the applications.
Resilience & Availability - We used availability sets for basic VM high-availability requirements. VMs running critical services requiring higher availability were deployed across availability zones protecting against failure of a single data centre.
Network Segregation - Within each resource group network components were segregated into individual VNETs with peering connections via the internal NVAs to control inter-VNET communications.
Management Platforms – Providing centralised management of ICS site security appliances, virtualised servers, anti-malware software, software updates, backups, network management and network performance monitoring.
Security Event Monitoring – Security events passed successfully out to our client’s SOC.
Secure Remote Access – Exploiting the capabilities of Azure to allow OT engineers to spin up remote access VM instances from pre-configured templates to provide a timebound remote access capability.
All core elements of the design were provisioned from Azure Resource Manager (ARM) formation scripts. Primarily this provided a coherent approach to adding additional resource in a structured, secure, centralised, and audited manner but also allowed for the quick and easy deployment of development and staging environments. ARM formation scripts will also provide the foundation for future iterations of the datacentre when the current platform reaches end of life, thus future proofing this design concept. The modular design of the solution provided further future proofing through full support to implement additional future datacentre solutions, both new and migrations that may use both PaaS and IaaS elements in Azure. This deployment method also allowed the data centre to be easily redeployed (potentially to a different environment if necessary) should a significant failure occur.
Bridewell provided detailed support guides for the full solution and training sessions for the client’s administrators who would be taking on management of the solution. We also provided early life support for 30 days post training and handover and warrantied the solution for 90 days.
Cyber Incident Exercising FAQs
Incident response exercising should be conducted regularly, for example annually or biannually, depending on your risk profile and requirements. It should also be undertaken when significant updates or changes are made to your cyber security infrastructure. This could be through new staff, systems or identified threats.
Tabletop exercising and live play are both cyber incident tactics designed to assess and develop an organisation’s cyber readiness. But they differ in their approach.
A tabletop exercise, as its name suggests, is based in the boardroom. It involves walking teams through potential scenarios and helping them understand their roles and responsibilities as incidents escalate. This can be valuable in building confidence and understanding in a workshop environment.
Live play goes one step further by simulating a real attack to trigger a cyber incident. The main benefit of live play is the ability to pressure-test individuals in a realistic attack scenario.
Live play and red teaming are both cyber security tactics used to test a team’s ability to effectively respond to threats.
Red teaming aims to test an organisation’s ability to detect and manage attacks by simulating an attempt to hack or compromise the IT environment. It aims to evaluate threat prevention and spot gaps in defences.
Live play is instead focused on testing the organisation’s response once an incident has already occurred. It focuses on response effectiveness – how teams communicate and ultimately remediate a live, escalating incident.
Why Us?
.svg?sfvrsn=428a1942_1){kind=icon}
Awards
Our team have won numerous industry awards, including 'Cyber Security Company of the Year' at the Cyber Security Awards 2026 and Best Cyber Security Service Provider' at the Cyber Security Awards 2025.
Certifications
Our people and services are highly accredited by leading industry bodies including CREST, the NCSC, and more. Our SOC holds extensive accreditations from CREST (including for CSIR and SOC2) and works closely with our cyber consultancy services.
Partnerships
As a Microsoft Partner, we also hold advanced specialisms in Cloud Security and Threat Protection. We’ve also implemented some of the UK’s largest deployments of the Microsoft Security stack, inc. Sentinel, Defender, Purview and more.
