Why executives need decision simulations

Security teams may investigate compromised systems, analyze suspicious activity, and recommend containment measures. At the same time, business leaders may need to decide whether critical services should remain operational, which stakeholders must be informed, and how to balance immediate disruption against the risk of further damage.

These decisions rarely arrive with complete information.

An investigation may still be underway. The scope of a compromise may be uncertain. Technical teams may recommend actions that carry significant operational consequences.

In these circumstances, cybersecurity becomes a leadership responsibility as well as a technical one.

Yet many organizations prepare extensively for the technical aspects of incidents while giving less attention to how executives will make decisions during the crisis itself.

Cyber incidents are business events

A major cyber incident can affect far more than the systems initially compromised.

A ransomware attack may interrupt operations. A cloud identity compromise may raise concerns about unauthorized access to sensitive information. An attack involving a third-party provider may disrupt services that the organization does not directly control.

The technical team is responsible for investigating and responding to the security aspects of the incident, but the consequences may require decisions across the business.

Depending on the organization and the nature of the event, several functions may become involved:

Not every incident requires all these functions. The level of involvement depends on its severity, business impact, and organizational structure.

However, when multiple functions are involved, their responsibilities can overlap.

A technical recommendation may create an operational problem. A business decision may introduce additional security exposure. A communication deadline may arise before the investigation has established all the facts.

This is where executive preparedness becomes important.

The NIST Cybersecurity Framework 2.0 recognizes cybersecurity governance as a fundamental part of managing organizational risk. Its Govern function addresses areas including organizational context, roles, responsibilities, policies, and oversight.

Knowing the incident response plan is not the same as using it

Organizations may have documented incident response procedures, escalation paths, crisis communication plans, and business continuity arrangements.

These documents are valuable, but their existence does not guarantee that they will function smoothly during an actual crisis.

A plan might state that a significant incident must be escalated to executive leadership. But practical questions remain:

• Who determines that the incident is significant?
• What information must accompany the escalation?
• Who can authorize an action that interrupts business operations?
• What happens when the designated decision-maker is unavailable?
• How are disagreements between security and operational teams resolved?

These questions may appear straightforward until participants must answer them in the context of an unfolding incident.

Both perspectives may be legitimate.

Knowing the incident response procedure is only the starting point. The harder questions are who has the authority to decide, what information is required, and how the competing risks should be evaluated.

Practice decisions when information is incomplete

One of the defining characteristics of a cyber crisis is uncertainty.

Early information may be inaccurate, incomplete, or contradictory. The situation can change as investigators uncover new evidence. Executives may be asked to make decisions before the full scope of an incident is understood.

For example, imagine a fictional organization experiencing suspicious activity in a cloud environment. The security team reports possible unauthorized access involving a privileged identity. At this stage, investigators cannot confirm whether sensitive information has been accessed. Leadership must decide how to respond to the potential exposure.

As the scenario develops, additional information becomes available:

The scenario does not necessarily have one universally correct answer. The appropriate response depends on factors such as the organization’s risk tolerance, legal obligations, technical evidence, and operational dependencies.

What can be evaluated is how participants approach the decision.

• Do they distinguish confirmed facts from assumptions?
• Do they request relevant information?
• Do they recognize the consequences of available options?
• Do they identify who has decision-making authority?
• Do they communicate what is known, what remains uncertain, and when the situation should be reassessed?

These are leadership capabilities that can be practiced and discussed.

Understand the trade-offs behind cyber decisions

Cybersecurity decisions often involve competing objectives.

A security team may prioritize preventing further compromise. Business operations may prioritize maintaining essential services. Legal advisers may focus on regulatory obligations and preserving evidence.

These priorities are not necessarily contradictory, but they may create difficult trade-offs. Consider several examples.

The purpose of a decision simulation is not to teach executives to choose security over business continuity—or the reverse. It is to help participants understand the implications of their choices and the information needed to make them responsibly.

For example, immediately shutting down a service may appear to be the safest technical option, but it could have serious consequences in an environment where availability is critical. Conversely, delaying containment to preserve operations could increase the potential impact of an ongoing compromise.

Turn policies into observable decisions

This distinction is particularly important when responsibilities cross organizational boundaries.

For example, an incident response plan may require leadership approval for major containment actions. During a simulation, participants may discover that the approval process is unclear or that different departments interpret the requirement differently.

The exercise can expose questions such as

• Does the incident commander have authority to act immediately in certain circumstances?
• Which decisions require executive approval?
• What happens if the normal escalation process is unavailable?
• Who is responsible for communicating the decision?
• How is the rationale documented?

These questions are not necessarily evidence of poor planning. They may reflect operational details that have never been tested in a realistic context.

Branching scenarios

Branching scenarios can be particularly useful. Instead of presenting participants with a fixed sequence of events, the exercise can introduce developments that respond to their decisions.

These outcomes are designed to explore consequences and prompt discussion. They should not be interpreted as predictions of what would necessarily happen in a real incident.

Communication is part of the response

During a cyber incident, accurate technical investigation is essential. But technical findings must also be communicated in a form that supports decisions.

A security analyst may report unusual authentication events, suspicious API activity, or indications of lateral movement. An executive may need to understand something different:

• What could this mean for the business?
• Which services might be affected?
• What actions are being recommended?
• What risks accompany those actions?
• How confident is the technical team in its assessment?

A useful simulation can test the exchange of information between technical specialists and decision-makers.

For example, a technical team might initially report that a privileged account has been compromised. Leadership may then need to determine whether the information is sufficient to authorize containment.

The exercise can reveal whether the report clearly distinguishes confirmed compromise from suspected activity, identifies affected systems, and explains the potential operational consequences. It may also reveal whether executives know which questions to ask.

Communication is not simply about producing shorter technical reports.

Test coordination across organizational functions

A significant cyber incident can require several teams to work together under pressure. Each function may have its own procedures, responsibilities, and priorities. A simulation can reveal whether these functions understand how their work connects.

These interactions are difficult to evaluate through technical exercises alone. A leadership-focused simulation can make them central to the scenario.

It may reveal unclear responsibilities, duplicated decision-making, missing communication channels, or assumptions about who is responsible for particular actions.

Evaluate the decision process, not just the outcome

An important challenge in executive simulations is determining what successful performance means.

Unlike some technical exercises, leadership decisions cannot always be evaluated through a simple correct-or-incorrect answer.

A decision may be reasonable based on the information available at the time, even if later developments reveal an unfavorable outcome. Conversely, a decision may produce a favorable simulated result despite weak reasoning or incomplete risk assessment.

Evaluation should therefore consider the quality of the decision process. Relevant observations may include:

Not every exercise needs to assess all these areas. The evaluation should reflect the specific objectives and responsibilities of the participants.

Use the after-action review to improve the organization

A decision simulation becomes more valuable when its findings lead to practical improvements.

After the exercise, participants can review what happened, which decisions were difficult, and where organizational processes created uncertainty.

Some findings may relate to documentation. Others may reveal unclear authority, missing communication procedures, or insufficient understanding of operational dependencies.

The CISA Cybersecurity Tabletop Exercise Package includes resources for documenting exercise observations and developing improvement plans.

The underlying principle is straightforward: the exercise should help the organization identify what needs to change.

Where appropriate, those changes can be revisited through another exercise. A later simulation may use a different threat scenario while testing whether the same decision-making weakness has been addressed.

Executive preparedness is an ongoing capability

No simulation can reproduce every pressure, consequence, or uncertainty of a real cyber crisis.

Executives may behave differently when facing actual financial losses, public scrutiny, regulatory obligations, or operational disruption.

This limitation does not make simulations irrelevant. It means their results should be interpreted appropriately.

A simulation provides an opportunity to examine decision-making processes, challenge assumptions, and identify organizational weaknesses under controlled conditions.

Repeated exercises can help organizations revisit important decisions as technologies, personnel, business dependencies, and threats evolve. For example, the introduction of new cloud services, AI-connected applications, or external technology providers may create additional dependencies that leadership should understand.

This aligns with the broader emphasis in NIST Cybersecurity Framework 2.0 on governance, risk management, and continuous improvement.

Leadership readiness must be practiced

Technical security capabilities are essential to effective incident response.

But during a major cyber crisis, technical expertise alone cannot resolve every question.

Organizations must also decide how to balance security and operational priorities, communicate uncertainty, assign responsibility, and act when the available information is incomplete.

These capabilities are difficult to develop through policies and presentations alone.

Executive decision simulations create opportunities to examine how leadership teams interpret information, coordinate across functions, and make consequential choices.

They do not eliminate uncertainty or guarantee a successful response. They help organizations identify weaknesses, clarify responsibilities, and improve the processes that support decisions under pressure.

References and further reading

1. NIST — The NIST Cybersecurity Framework (CSF) 2.0 ↗

   Provides a framework for managing cybersecurity risk, including governance, organizational responsibilities, risk management, and continuous improvement.

2. NIST — Computer Security Incident Handling Guide (SP 800-61 Rev. 3) ↗

   Guidance on integrating incident response into cybersecurity risk management, including preparation, response, and improvement.

3. CISA — Cybersecurity Tabletop Exercise Package (CTEP) ↗

   Resources for planning and conducting cybersecurity exercises, including after-action reviews and improvement planning.

4. UK National Cyber Security Centre (NCSC) — Exercise in a Box ↗

   A free exercise toolkit designed to help organizations practice and assess their response to cyber incidents.

5. NIST — Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities (SP 800-84) ↗

   Guidance on structured exercise planning, evaluation, and using exercise findings to improve organizational preparedness.

Editorial note: This article presents an original CySource perspective informed by publicly available cybersecurity guidance. The scenarios are illustrative and do not represent specific client engagements, published research findings, or independently verified organizational outcomes.