Practice the bad day before it happens

An incident exercise is a rehearsal for a crisis that hasn't happened. The most common format is the tabletop exercise: a small group sits down, a facilitator describes an unfolding incident — a ransomware note, a warehouse fire, a supplier that just went dark — and the group talks through what they would do, decision by decision, while the facilitator adds complications.

Nothing technical is tested. No systems are touched. What gets tested is judgment under uncertainty: who decides, what information they ask for, who they call, what they say to customers, and in what order.

A good exercise ends with two artifacts: a record of what the group decided, and a short list of concrete improvements with owners and dates. The first proves you practiced; the second is why the practice mattered.

Real incidents are decided in the first hours, by tired people, with incomplete information. Organizations that have rehearsed make those hours shorter and calmer. Organizations that haven't, improvise — and improvisation is where notification deadlines get missed, evidence gets deleted, and customers hear about the problem from someone else first.

Exercises find gaps while they are still cheap. The missing phone tree, the unclear authority to shut systems down, the regulator nobody knew they had to call — each of these costs an awkward conversation in a drill and a catastrophe in a real event.

Insurers, auditors, and frameworks (NIST SP 800-61, ISO/IEC 27035, HSEEP) all expect exercised plans, not just written ones. A binder that has never been rehearsed is a hypothesis, not a capability.

1. Pick one incident, made plausible. Anchor it in your real organization: your systems, your customers, your one person who holds the keys. Generic scenarios produce generic learning. "Our payroll provider emails a breach notice on the Friday before payday" beats "hackers attack."

2. Write decisions, not trivia. Each decision point should force a real trade-off: shut down the system and stop the bleeding, or keep trading and risk spread? Notify customers now with partial facts, or wait for certainty and lose the narrative? If there is an obviously correct answer with no cost, it isn't a decision.

3. Escalate with injects. A scenario is a story that fights back. Timed events — the journalist calling, the second system failing, the executive demanding an answer — recreate the pressure that makes real incidents hard. Two to four injects is plenty.

4. Define what good looks like before anyone plays. For every decision, write the best-practice response and what a weak one looks like. This scoring guidance is for the evaluator, never the players — seeing the answer key mid-exercise destroys the rep.

5. Keep it short. Five decisions and thirty minutes beats twenty decisions and a lost afternoon. Finishing is a feature; people re-book exercises that respected their calendar.

Before: choose the scenario, invite the people who would actually be in the room (not just IT — include whoever talks to customers, press, lawyers, and staff), and agree that the room is a no-blame zone. Hesitation in a drill is data, not incompetence.

During: present the opening, then stay out of the way. Your job is to ask "what do you do?" and "what would you need to know?", deliver injects on time, and capture decisions verbatim. Never coach toward the right answer — a wrong turn taken here is a lesson banked.

After: debrief while it's fresh. What did we decide? Where did we hesitate? What did we wish existed — a contact list, an authority, a template? Convert every wish into a corrective action with an owner and a date, then schedule the re-run. An exercise without follow-through is entertainment.

Dry Run Ready plays the facilitator: it presents the scenario, adapts the story to your answers, applies the pressure, and scores each decision against written best-practice guidance. You get the scorecard, a plain-language summary for leadership, and a corrective playbook — the same artifacts a consultant-led tabletop produces, on your schedule.

Start with a published scenario, invite teammates to answer alongside you, and when you're ready, write your own scenario in the studio and let the AI editor sharpen it.