Most incident response plans have never been run under time pressure, which is the only condition in which they will ever be used. We simulate a live cyber incident against your actual team, watch what happens to escalation and coordination, and give you a readiness assessment you can act on.
An incident response exercise is a facilitated simulation of a genuine cyber incident, run against your real response team using your real plan. Information arrives progressively through timed injects, exactly as it does in a real incident: an alert, then a second alert that contradicts the first, then a customer complaint, then a call from a journalist, then a data set appearing somewhere it should not be.
The team works the incident in real time. We observe and record what happens: who was contacted and how quickly, whether the escalation criteria were applied or improvised, who felt able to make a containment decision, how legal and communications were brought in, and whether anyone reached the point of assessing the personal data breach notification position.
Exercises run from a focused half-day session for a technical response team through to a full-day multi-team exercise involving IT, legal, HR, communications and executive leadership. The format is functional rather than technical: no systems are touched and no production environment is put at risk.
Written plans fail in predictable ways under real conditions. The escalation contact has left the company. The plan lives on the file server that has just been encrypted. Two people each assume the other has called the CEO. Nobody is sure who has authority to disconnect a production system, so nobody does, and the intrusion spreads for another six hours.
Timing is now a compliance issue. Under the amended PDPA, a personal data breach must be notified to the Commissioner, and affected individuals must be told where the breach is likely to cause significant harm. Meeting that obligation requires a team that can determine within hours whether personal data was involved, whose data it was and how many records are affected. That determination is difficult to make for the first time during an actual crisis at eleven at night.
There is also the coordination problem. Incident response is not an IT activity. It requires legal to assess obligations, HR to handle an insider dimension, communications to manage customers and press, finance to authorise emergency spend, and an executive who can make a call on shutting down a revenue-generating system. Those functions rarely practise working together until they have to.
Every exercise is built around your own plan, your own systems and a scenario relevant to your sector, so the findings apply directly rather than generically.
Scenarios drawn from what actually happens to organisations like yours: ransomware detected on a file server, credentials abused from an unexpected country, an insider exfiltrating a customer database before resigning, a third-party supplier compromise reaching your environment, or personal data appearing on a public forum.
We test whether escalation criteria are understood and applied. Who decides that an event is an incident? At what threshold does leadership get called at night? What happens when the primary contact does not answer? These gaps are invisible on paper and obvious within twenty minutes of an exercise.
A structured evaluation across detection, triage, containment, communication, evidence handling and recovery, scored against a maturity framework so you get a defensible readiness position rather than an impression.
The exercise deliberately generates situations that no single function can resolve alone, which is where coordination breaks. We observe handoffs, decision authority and information flow between IT, legal, HR, communications and the executive team.
Injects are timed so the team must confront the personal data breach assessment while still fighting the technical incident, because that is the real sequencing. We test whether the organisation can determine scope, affected individuals and notification position inside the window the PDPA allows.
The exercise ends with a structured hot debrief while memory is fresh, followed by a formal lessons-learned report. Every finding is converted into a specific plan amendment, a runbook addition or a named owner rather than a general observation.
The value is in discovering the failures in a room with coffee rather than at two in the morning with customers on the phone.
Every exercise finds stale contact details, undefined authority, missing runbooks and dependencies nobody had considered. Finding them during a facilitated session costs a day. Finding them during an incident costs considerably more.
The most common cause of slow containment is nobody being certain they are allowed to act. Exercises force that question into the open and the answer becomes documented delegated authority.
Teams that have rehearsed the breach assessment once can do it under pressure. Teams that have not tend to lose the first day arguing about whether it is a notifiable breach at all, which is exactly the day they cannot afford to lose.
The first conversation between your IT manager and your communications lead should not happen while a journalist is holding. Exercises build those working relationships before they are load-bearing.
A documented exercise with dated findings and closed actions demonstrates that the organisation prepared rather than merely wrote a policy. That evidence matters during a Commissioner enquiry and at cyber insurance renewal.
Executives frequently expect recovery in hours when the realistic answer is days. An exercise adjusts that expectation before it becomes a public commitment that cannot be met.
Three to four weeks from scoping to the lessons-learned report, with the exercise itself occupying between half a day and a full day of your team's time.
We read your existing incident response plan, escalation matrix, contact lists and any relevant runbooks before designing anything. This review alone usually produces findings, since documents drift out of date faster than anyone expects.
We build a scenario around your actual environment, sector and risk profile, with a timed inject schedule. The design is reviewed with your sponsor but withheld from the participants, because a scenario that has been circulated in advance tests nothing worth testing.
Participants receive a short briefing covering ground rules, the fact that the exercise is a test of the process rather than of them, and the safe-word convention for pausing if a real incident occurs during the session. Setting the tone here determines how honestly people behave.
Injects are released on schedule while facilitators observe and record. We deliberately introduce complications: a key person unreachable, contradictory technical information, an early media enquiry, a customer asking directly whether their data is affected. The pressure is the point.
Immediately after the exercise we run a structured debrief while everything is fresh. Participants surface most of the real findings themselves in this session, which matters, because a finding a team identifies is a finding a team will act on.
We deliver the readiness assessment and lessons-learned report, then work with your team to amend the plan, update the escalation matrix and close the gaps. A follow-up exercise six to twelve months later verifies the changes hold. Executive-level scenarios are covered by our ransomware tabletop exercise.
The output is a set of documents that change your plan, not a certificate that says an exercise took place.
A scored evaluation across detection, triage, escalation, containment, communication, evidence handling and recovery, with the maturity position for each.
A minute-by-minute reconstruction of the exercise showing what was injected, how the team responded, where time was lost and which decisions were made by whom.
Every finding recorded with severity, root cause, recommended action, named owner and target date, in a format that can be tracked to closure.
Marked-up amendments to your incident response plan and escalation matrix, including corrected contact details, defined decision authority and the missing runbook steps.
A decision workflow for assessing whether an incident constitutes a notifiable personal data breach, who determines it, what evidence is required and how the notification is prepared inside the required window.
A short report for the board and audit committee covering current readiness, the material gaps, and what is being done to close them.
Any organisation with an incident response plan should test it. Any organisation without one should build it first, which we can also help with.
Regulated sectors and organisations holding significant volumes of personal data have both the highest impact and the tightest notification obligations.
Smaller organisations run a single combined team exercise. Larger organisations often run a technical exercise and a separate executive exercise, then a combined one.
Incident response is cross-functional by definition, and an exercise that only involves IT tests only a fraction of the real problem.
An exercise is only as good as the honesty of the debrief and the specificity of the actions that come out of it.
We design exercises around governance outcomes: decision authority, escalation thresholds, regulatory assessment and board reporting. The technical detail is realistic, but the questions we press hardest are the ones a regulator or an audit committee will ask afterwards, because those are the ones organisations are least prepared for.
Findings arrive as specific amendments to specific documents with named owners, not as observations. Where a gap is structural, for example an outsourced IT provider with no contractual response time, we say so plainly even though that is an uncomfortable finding to deliver.
Our consultants have run compliance, data protection and security functions inside Malaysian organisations, not only advised on them from outside. That shows up in the advice: we know what a lean IT team can absorb in a quarter, and we know which recommendations get quietly shelved.
Scenarios use Malaysian references your staff will recognise, from DuitNow payment requests and e-invoice notices to LHDN and EPF correspondence. Reporting is framed against the obligations your regulators and auditors actually cite, including the 72-hour personal data breach notification duty introduced by the 2024 amendments to the PDPA.
Where an exercise reveals a competence gap rather than a process gap, follow-up training can be delivered as an HRD Corp claimable programme, including our incident response and digital forensics course, subject to grant approval before delivery.
Tell us your headcount, your industry and what triggered the interest, whether that is an audit finding, a near miss, a board question or a regulator letter. We will come back with scope, timeline and a fixed quotation. No obligation, and we will say so if you do not need us yet.
