Inside Databarracks' Cyber Recovery Wargame

Last week, The Barbican Centre was the setting for Databarracks’ first Cyber Recovery Wargame of 2025: Defending Deepfakes & Disinformation, sponsored by Commvault.

Continuity and Resilience leaders from a broad range of sectors came together to test their cyber recovery strategies and intuitions in a highly interactive scenario designed and led by Databarracks’ Director of Resilience, Chris Butler.

Live polling and peer discussion guided the response to a compelling and increasingly challenging narrative, which centred on a deepfake video of a CEO at the heart of a ransomware incident. As the scenario escalated, attendees had to contend with operational paralysis, reputational damage and a perfect storm of disinformation.

The real-world relevance of the Wargame was highlighted by events unfolding outside the room. With M&S still recovering from a major cyber attack, news of a Co-op breach broke during the event itself, and Harrods was hit the following day. It was a timely reminder that these threats are not just plausible – they’re already here.

Deepfakes and Disinformation

Chris Butler and Charlie Maclean-Bristol, Director of Databarracks’ PlanB, opened the day by introducing the theme: Deepfakes and Disinformation. They set the context with high-profile examples from politics, entertainment and industry – including the 2024 Arup fraud, deepfake videos of Trump and Zelensky and viral synthetic Tom Cruise content – showing just how convincingly, and cheaply, AI can now be weaponised.

As demonstrated later in the Wargame itself, a deepfake video can today be produced for less than £30 and go viral in minutes – making it a serious risk for organisations of any size. Deepfakes have quickly gone from curiosity to credible cyber weapon.

The World Economic Forum recently ranked misinformation and disinformation as the top global threat for the next two years, linking them specifically to cyber warfare, espionage and social polarisation.

To understand current levels of preparedness, we asked attendees to rate their confidence in responding to an AI-or deepfake-enhanced cyber incident. Responses varied widely, highlighting a clear divide in how ready organisations feel. While the risks are widely recognised, many organisations still lack the capability to respond effectively to these attacks. And that gap between awareness and readiness set the stage for the day’s scenario.

Live crisis simulation

The scenario centred on a cyber attack against a fictional UK theme park operator. Attendees, working in teams, had to respond in real time to each stage of the unfolding incident. With every update, new complications emerged – from reputational damage and customer safety concerns to media scrutiny and activist pressure. Should they pay the ransom? Go public with the deepfake findings? Prioritise speed or thoroughness in recovery? Live polling and group discussion drove decision-making, with some dilemmas dividing the room.

Insightful and genuinely engaging, The Wargame showed just how disorienting and complex modern cyber crises can become. Attendees were able to explore tough decisions, refine their crisis plans and gain practical experience in navigating AI-driven threats.

Expert Q&A

The session concluded with a Q&A with Rupert Small, whose company, Egregious, specialises in helping organisations counter AI-powered deception and disinformation.

Reflecting on the scenario and the contributions from the room, Rupert discussed the highly specialised deepfake detection landscape and generational differences in perceiving the blurred line between fact and fiction online. He brought into focus just how naturally the human mind gravitates towards Deepfakes.

It was a thought-provoking close to the morning, which led into an informal networking lunch where attendees exchanged reflections and experiences from their own industries.

Key takeaways

Towards the end of the day, we asked attendees about their priorities for improving resilience.

The top 3 responses were:

• Cyber incident exercising
• Cyber incident response
• Business continuity planning

For each of these priorities, organisations now need to factor in the risks posed by deepfake technology, especially as it becomes cheaper and more accessible.  Chris Butler and Charlie Maclean-Bristol have shared the following best practice guidelines for doing so:

• Raise awareness of deepfake and social engineering threats and train staff to spot synthetic content.
• Promote a culture of healthy scepticism that priorities verification over speed when reacting to content.
• Update crisis management and communication plans to address deepfake threats, including clear procedures for responding to and debunking disinformation.
• Regularly test incident response and recovery plans with exercises that include deepfake scenarios.
• Build partnerships with external experts like PR firms, legal advisors and digital forensics specialists to ensure a faster, more coordinated response when incidents occur.
• Invest in workable, rehearsed data backups and IT disaster recovery for vital data and critical systems

Looking ahead

Thank you to everyone who attended and contributed to the Wargame. Your input on the day and post-event feedback helps us shape future Wargame scenarios and ensure they’re as engaging and challenging as possible.

If you couldn’t attend or would like to revisit the content, you can download the slides here: Download slides