The future of resilience exercises: AI, agency and learning through failure

Drawing on lessons from his time in the fire and rescue service and experience leading exercise design, Stuart Lonie, Business Resilience Consultant at Databarracks, considers how resilience exercising needs to evolve to give participants greater agency and make the most of AI. 

There is a common saying in emergency response: in a crisis, we don’t rise to the occasion; we sink to the level of our training. 

I think there is a lot of truth in that. Under stress, we tend to fall back on what we know and what we have practised. That is one of the reasons exercising is so important. It gives people the opportunity to experience difficult situations, practise making decisions and learn from mistakes in a safe environment. And we need to do more of it. 

Whether it is a short tabletop or a complex simulation, the principle is the same: the more opportunities people have to practise responding to disruption, the more experience they have to draw upon when faced with the real thing. 

The challenge is that the environment we are preparing people for is continually changing, and at a rapid pace. As organisations look to the future, the question is not simply how often they exercise, but how they can make every opportunity to practise more valuable. 

For me, there are 3 things we need to get right: making exercises reflect the real world, giving participants meaningful control over what happens and allowing them to learn from failure. These principles should guide how we design exercises, with AI helping us put them into practice. 

Design exercises for an interconnected world 

Organisations don’t operate in isolation. They are part of an increasingly complex ecosystem involving suppliers, technology, infrastructure, customers, regulators, government and many other dependencies. During a crisis, the organisation itself may not even be the actor with the greatest influence over what happens next. 

A supplier’s response, a regulator’s intervention or the failure of a shared service can change the course of an incident, regardless of the decisions an organisation makes internally. Exercises need to reflect these wider influences, not just the actions of the organisation taking part. 

That complexity presents a challenge for exercise designers. How do we create realistic scenarios that account for these external influences while allowing participants’ decisions to shape what happens next? 

Give participants agency 

Many traditional exercises are, by necessity, reasonably linear. We present a situation, participants discuss it, make decisions and the exercise moves on to the next inject. 

This approach works when participants’ decisions broadly follow the route anticipated by the exercise designer and the next inject is a logical progression. But a serious limitation becomes apparent when participants make a credible decision that takes the scenario off script. If the next inject doesn’t reflect that decision, it can feel as though their actions have made no difference. When participants are no longer shaping the outcome, the scenario is simply happening to them. That’s why their decisions must be allowed to land. 

In a real incident, decisions don’t disappear when we move on to the next problem. They change the situation. They commit resources, consume time, close off options and influence how other people respond. Sometimes the effect isn’t apparent until much later. 

I’ve experienced that personally. During my time in the fire service, I made an early decision at an incident. I committed a team to the wrong task, and the situation quickly snowballed. Resources I needed elsewhere were now committed, valuable time had been lost and I was trying to correct that initial mistake while still dealing with the incident developing in front of me. One poor decision had created further problems, and each of those problems placed additional pressure on the decisions that followed. 

I learned more from experiencing the consequences of that decision than any classroom lecture could ever have taught me.

That’s what we need to recreate in resilience exercises. Participants need genuine agency, with their decisions driving the scenario and having credible consequences.

This isn’t a new idea. Wargaming has modelled cause and effect for a long time. The difficulty is doing it credibly within complex business environments, where the number of variables and potential interactions quickly becomes difficult to model.

An exercise designer has to understand what the consequence of a decision might be, how it affects the wider environment, how other actors respond and what second and third order effects emerge. Then we need to turn that back into a credible situation for participants to deal with.

And if we’re going to give participants genuine agency, we also have to accept that they won’t always make the right decisions.

Ensure failure is an option 

Participants should be allowed to fail. 

In the fire service, the drill ground was where you made your mistakes. You didn’t set out to fail, and you certainly didn’t want to repeat the same mistake, but if you were going to get something wrong, that was where you wanted to do it. Not at a real incident. 

Resilience exercises should provide the same safe environment. Participants should not be set up to fail, but they must be free to make mistakes, experience the consequences and learn from them. 

Treat AI as a tool, not the toolbox 

Bringing these elements together in a credible, realistic exercise is difficult, but AI offers new ways to approach the challenge. 

Used properly, AI gives experienced exercise designers greater capability to model consequences within complex environments and explore the interactions between them. We can examine second and third order effects that would previously have been extremely difficult and resource-intensive to model in sufficient depth. 

We can explore how different actors might respond to a decision, how those responses interact with each other and how the operating environment changes as a result. That creates the potential for exercises that are less dependent on a predetermined route and increasingly shaped by the people taking part. 

AI also has the potential to reduce some of the work involved in developing and adapting scenarios, making it easier to create varied exercises and give people more opportunities to practise. 

We are already beginning to apply this thinking at Databarracks. Our Cyber Recovery Wargames use a company-developed simulation platform to turn real cyber incidents into interactive scenarios, allowing participants to test their response and experience consequences as the situation develops. 

While its role in resilience exercising will undoubtedly grow, for now at least, AI should be seen as another tool, not the whole toolbox. AI should support, not replace, the judgement of experienced exercise designers. Its outputs must be challenged and validated to ensure that every development remains credible, relevant and appropriate. 

Preparing for what comes next 

The purpose of exercising is ultimately to prepare people to make good decisions during an incident. 

If we want people to become better at making those decisions, we need to give them opportunities to practise. They need agency. They need to be allowed to succeed, to fail, to feel the consequences of their decisions and to learn from that experience. 

The resilience exercising of the future should be more frequent, more complex and more consequential. 

We now have tools that can help us. We should use them. 

The crises organisations face have evolved. Our exercising needs to evolve with them. 

Make your next resilience exercise count

Databarracks is an NCSC Assured Cyber Incident Exercising Provider.

Our expert-led exercises give your organisation practical experience of responding to a cyber attack, helping you test your plans, identify weaknesses and prepare for a real crisis.