Executive & Crisis Team
Decide.
Priorities, escalation, continuity, stakeholders and decisions with incomplete information.
Capability Development · Role-Based Readiness
FROM KNOWLEDGE TO OPERATIONAL CAPABILITY.
Knowing what to do is only the starting point. CyberUP develops the ability to do it: in your role, alongside others, under pressure. Executives, Cyber/SOC teams, IT/OT and the wider workforce prepare through experiential training, exercises and simulations grounded in their operating context.
One organisation, different capabilities
Every role needs to be ready to play its part.
Readiness does not mean everyone needs the same skills. It means each function recognises when to act, understands its remit and coordinates with the rest of the organisation.
From role to contribution
Different responsibilities. One coordinated exercise.
Cyber / SOC / IR
Respond.
Detection, investigation, containment, technical escalation and operational coordination.
IT / OT / ICS
Protect.
Defence of critical systems and processes, service continuity and support for recovery.
Workforce
Recognise.
Recognising signals, reporting useful information and acting in line with established procedures.
The development progression
From understanding
to action.
The pathway progresses as capabilities develop: from understanding a role to acting in realistic conditions and demonstrating a coordinated response.
Learn
Build a shared understanding.
Knowledge, procedures, responsibilities and context establish a common foundation for action.
FocusUnderstanding the role.Exercise
Practise decision-making.
Tabletop exercises, workshops and guided scenarios test roles, handovers and dependencies.
FocusPractice and coordination.Simulate
Introduce realistic pressure.
Simulation introduces an attack, uncertainty, time pressure and operational consequences.
FocusObservable behaviour.Prove
Turn the response into evidence.
Performance is observed and discussed in the debrief to identify practical improvements.
FocusEvidence from the exercise.
The evidence relates to the scenario, roles and exercise conditions. It does not guarantee the response to every future incident.
Role-Based by Design
The same crisis.
Different capabilities.
Each programme is built around what a role needs to deliver at a critical moment. The measure is not how many modules someone completes, but the capability they can apply when it matters.
Programme design perspectives
Leadership
Executive
- Capability to develop
- Decision-making, escalation and crisis leadership.
- Conditions to exercise
- Incomplete information, competing priorities and responsibilities that need coordinating.
Technical response
Cyber / SOC
- Capability to develop
- Detection, triage, containment and handovers.
- Conditions to exercise
- A simulated incident requiring analysis and operational coordination.
Systems and processes
IT / OT
- Capability to develop
- Service continuity, isolation of affected systems and recovery.
- Conditions to exercise
- Operational impact and dependencies between infrastructure, services and processes.
Behaviour
Workforce
- Capability to develop
- Recognition, reporting and actions aligned with procedures.
- Conditions to exercise
- Plausible requests, pressure and unusual signals in everyday work.
The programme connects the capabilities of individual roles to the organisation’s response.
Experiential Development
Capability
develops through
practice.
A programme can combine theory, experiential training, exercises and Cyber Arena simulations. The format depends on the role, maturity and operational context.
The content follows the role.
Knowledge, guided practice and simulation are combined around relevant responsibilities, procedures and scenarios. The debrief connects what happened to the capabilities that need developing.
- On-site
- In-person activities within the agreed programme and environment.
- Remote
- Remote participation, subject to the activities and configuration.
- Cyber Arena
- Simulation in a controlled environment suited to the exercise objectives.
The programme improvement cycle
Capability is not
a finished product.
It keeps developing.
Every exercise produces evidence. Observed gaps become development priorities, and improvements are tested again. This cycle guides the programme’s evolution over time.
Baseline
Understand current capability.
Build
Develop role-specific capabilities.
Exercise
Exercise in context.
Measure
Observe performance.
Improve
Address priority gaps.
Re-test
Check improvement.
New evidence updates the programme baseline and informs the next activities.
Individual development and organisational capability
Verify change. Do not assume it.
Individual capability
Understanding of the role, knowledge of procedures and behaviour observed during the exercise.
Team capability
Quality of shared information, coordination and alignment of the response with programme objectives.
Build your programme
Turn knowledge
into operational capability.
We start with critical roles, relevant scenarios and current maturity. Then we build a pathway to develop and test your organisation’s response.
Where to start
Roles. Scenarios.
Required capabilities.
Executives, Cyber/SOC, IT/OT and the wider workforce: the programme is shaped by what each role needs to do.
On-site · Remote · Cyber Arena
Write to us
Email us directly or fill in the form below: we’ll get back to you.
Email us: info@cyberupinstitute.com
Your current interest: Capability Development