How do resilience leaders perform under pressure? Key insights from the Anatomy of a Crisis wargames

The Databarracks Anatomy of a Crisis wargame puts leaders inside a simulation closely based on a real cyber attack, like those at M&S, the Royal Mail and the British Library.

As the crisis unfolds, participants make decisions on containment, communications, operational continuity and recovery, responding in their own words through Databarracks’ simulation platform.

Their responses are assessed and scored in real time against a framework developed for each decision, giving us a dataset that shows not only what individual leaders would do, but the patterns that emerge across the room.

We have analysed 2,117 scored responses from 303 participants across 147 organisations and 14 sectors to see where leaders were strongest, what they commonly missed and how role and sector shaped their responses. Here is what we have learned.

1. Leaders were stronger on judgement than execution

The 3 areas where participants scored lowest on average all concerned technical execution: containing the attack while maintaining essential services, operating when systems could not be trusted and recovering cleanly.

Participants were generally more complete when addressing decisions about public communications, customer protection and ransom strategy. On average, scores for governance and communication decisions were 17 points higher than for technical execution.

This does not mean leaders need to become technical specialists. It shows the importance of being able to translate strategic decisions into controlled technical and operational action. Crisis teams need the right expertise around the table to do that.

2. The obvious first move often lacked a second

The clearest pattern in the more technical decisions was not that participants chose the wrong initial action. It was that many answers stopped before addressing what needed to happen next.

In the containment decision, 66% of responses called for isolating affected systems. However, far fewer covered the detail needed for effective containment:

• 7% gave a risk-based rationale for what should be shut down or kept running.
• 10% explicitly considered protecting critical systems.
• 20% mentioned preserving forensic visibility before systems were wiped or rebuilt.

Isolation is often the right instinct, but it is not a complete containment strategy. The strongest responses went further, explaining what should remain operational, what needed protecting and how containment could be achieved without compromising the investigation or recovery.

3. Secure crisis command was a blind spot

Operating when systems could not be trusted was the lowest-scoring area in the simulation.

Many participants recognised that they would need to move away from corporate systems if those systems could no longer be trusted.

However, only 11% explicitly described assuming compromise and moving to clean communication channels. Just 8% mentioned verifying identity before trusting instructions.

Moving to another messaging application does not make crisis communications secure. Attackers may already have access to corporate accounts, contact directories or compromised identities.

Crisis teams need pre-agreed clean communication channels, trusted contact details, identity verification and a reliable decision log.

These are difficult arrangements to improvise during an attack. They need to be established and rehearsed in advance.

4. Leaders took a business-wide view of critical operations

As the crisis moved from immediate response to prolonged disruption, participants had to make difficult choices about the organisation’s minimum viable operations: what needed to keep running and what it could afford to stop.

Responses went beyond technology. Participants considered critical services, priority customers, regulatory and contractual obligations, cash flow, employee welfare, suppliers and wider dependencies.

They also considered how essential operations could continue when normal systems were unavailable, including manual workarounds and alternative ways of working. The stronger responses went further, considering the controls needed to sustain those workarounds through a prolonged outage.

A manual process that works for several hours may become unsafe or unsustainable over several weeks. It can introduce security risks, put pressure on employees and create data that needs to be reconciled when systems are restored.

5. Recovery did not always begin from a trusted foundation

The final stages of the exercise exposed a different challenge: the difference between restoring services and recovering safely.

Only 11% of responses to the recovery decision explicitly mentioned restoring from backups that had been checked and confirmed as clean. Identity services and privileged access were also frequently absent from recovery priorities.

Restoring applications into an environment with compromised accounts or access controls can allow the attacker straight back in. The stronger responses prioritised securing identity and privileged access, validating backups and establishing a clean recovery environment before reconnecting dependent services.

The priority is not to restore everything as quickly as possible, but to restore the right services in the right order from a trusted foundation.

6. Different professional roles brought complementary strengths

Overall scores were relatively close across the different professional groups. What varied was the part of the crisis each group prioritised.

Risk teams were strongest at prioritising recovery by business criticality and assigning board ownership. Technology participants brought forensic discipline, backup verification and technical recovery. Compliance and governance participants escalated quickly and involved specialist support. Operations teams focussed on customers, employees and rebuilding safely.

Business continuity and resilience professionals were quickest to establish situational awareness and formal command structures. They were less likely to address some of the detailed forensic considerations identified by technology participants.

No single professional perspective consistently covered every part of the crisis. Instead, the strengths were complementary. The strongest elements across the cohort would combine the resilience professional’s command structure, the technologist’s forensic discipline, the risk professional’s prioritisation and the operations team’s focus on customers and safe recovery.

The finding supports the case for building and exercising cross-functional crisis teams, so those perspectives are available when decisions need to be made.

7. No industry had a clear resilience advantage

Among sectors with at least 10 participants, average scores were separated by only 9 points. Most sectors clustered closely around the overall cohort average. Banking, insurance, technology, retail, utilities and the public sector were all close to the cohort average.

No clear sector advantage emerged. The same weaknesses appeared across industries: incomplete containment decisions, crisis command that relied on potentially compromised systems and recovery plans that did not always begin from a clean foundation.

The differences between professional roles were more revealing than the differences between industries. How a crisis team is composed may therefore tell us more about the perspectives it brings to a cyber crisis than its sector alone.

What strong answers looked like

The strongest responses did more than identify an immediate action. They explained what should happen next, why it mattered and how the risks would be controlled.

Containment vs Continuity

Isolate critical and affected systems, prepare to be able to shut down if necessary. Shut down non-critical systems to prevent lateral movement. Keep critical systems running so forensic information can be collected.

Technology participant

The Ransom Decision

Don’t pay yet — negotiate to buy time while you assess backup integrity. Verify it. Insurer-appointed specialists engage, not the CEO. Preserve evidence and legal position throughout. Rebuild in parallel regardless; you cannot trust decryption keys.

Technology participant

Recovery, Not Restoration

Restore identity systems first — IAM and AD — and ensure all passwords are reset, from an air-gapped clean recovery room … restore customer-facing systems last to avoid any reinfection.

Operations participant

These responses reflect a wider pattern in what good crisis decision-making looks like. They establish the immediate action, but they do not stop there. They consider sequence, dependencies, authority, evidence and the controls needed to manage the next risk.

Summary

The findings show what cyber resilience requires in practice: prepared leadership, clear decision-making, secure crisis command, defined operational priorities and a trusted route to recovery. No single role provides all of that expertise. It needs to be built and rehearsed across the crisis team before an attack occurs.

Put your response to the test

A cyber recovery wargame is a step short of a real crisis, but a long way beyond theory. The Anatomy of a Crisis wargame gives you and your colleagues a chance to test your decisions under pressure, see their consequences and benchmark your response against industry peers and how an organisation responded to a real cyber attack.

Each wargame is followed by an expert panel and live Q&A, where you can hear from people who have managed crises like those behind the simulation.

If you are an enterprise resilience leader, working within a regulated industry, then please join us at a future Anatomy of a Crisis wargame.

View upcoming cyber recovery wargames

Learn key resilience lessons and understand the recovery and response to the Marks and Spencer cyber attack in this Anatomy of a Crisis report.