Adversarial simulation
Red Team
Conducts the attack and adapts actions to the scenario, introducing pressure and adversarial techniques in a controlled way.
ResponsibilityDevelop the events defined for the exercise.
How the Cyber Arena works
FROM SCENARIO
TO EVIDENCE.
A CyberUP exercise turns an abstract risk into an observable sequence of events, decisions and consequences. The attack is controlled. The pressure is real. Each stage generates evidence to improve the response.
Before the attack
An effective exercise
starts with its design.
Simulation begins with the operational context: objectives, critical systems, roles, dependencies and decisions to test. The scenario is tailored to the organisation’s preparedness and the outcomes to observe.
- MissionWhat needs
to be tested. - Operational objectives, participating functions, critical assets and exercise success criteria. Start with the response to be tested, not an attack selected in isolation.
- ScenarioThe pressure
to introduce. - Threats, scenario injects, complexity and progression are adapted to the IT and OT / ICS context and participants’ preparedness.
- Rules and observationHow it runs.
What to observe. - Teams, communication channels, measurement criteria and decision points are defined before the exercise. Timing and intensity depend on the scenario, not a universal time window.
Red · Blue · White
Three teams.
One exercise.
The interaction creates a realistic challenge within the exercise rules. Attack, response and supervision have distinct responsibilities; the teams are not phases activated one after another.
A shared context
The scenario connects attack, response and control.
Red Team actions and the Blue Team response take place within the Arena. The White Team manages their progression and observes participants’ behaviour.
Red Team↔Blue TeamWhite Team · supervision throughout
Facilities, access and team composition depend on the solution and exercise objectives.
The organisation in the exercise
Blue Team
Includes client participants: Cyber, SOC, IT, OT and operators, alongside decision-makers and crisis functions where relevant.
ResponsibilityInterpret events, respond and coordinate.
Coordination and observation
White Team
Coordinates the exercise, oversees progression, observes participants’ behaviour and leads the final debrief.
ResponsibilityKeep objectives, execution and evidence aligned.
Supervision spans the whole exercise.The White Team follows the entire exercise. The Control phase makes that function explicit; it does not mark its activation.
Exercise Lifecycle
One scenario.
Five phases. One reference lifecycle.
From design to improvement, each phase has a specific purpose. This is the exercise structure; it does not replace the organisation’s incident response process.
Open a phase to explore the activities and observation criteria.
DesignDefine the exerciseObjectives, scope and exercise conditions.
What happens
Systems and processes, participants, the scenario, channels and rules are defined. The decisions to be tested guide the design of events.
What is agreed
Shared objectives, capabilities to observe and criteria for assessing the response. The Arena configuration reflects the agreed scope.
AttackActivate the scenarioPlanned events enter the exercise.
What happens
The Red Team launches the planned actions and introduces scenario events. Technical and decision-making pressure develops within the agreed rules.
What to observe
The relationship between injected events, available signals and initial reactions. The attack is part of the test, not its only focus.
RespondPut the response into practiceInformation, decisions and actions need to align.
What happens
Participants recognise and analyse signals, assess priorities and escalate. They exercise containment and recovery while coordinating technical and decision-making responsibilities.
What to observe
Information quality, escalation thresholds, decisions and coordination. Legal and Communications act according to the scenario and procedures, not at a preset minute.
Incident response has its own distinct reference sequence. Explore Cyber Crisis Readiness
ControlObserve and coordinateExecution, objectives and evidence remain aligned.
What happens
The White Team oversees progression and coordinates the Red and Blue Teams. Observations help reconstruct events, behaviours and decisions.
What to observe
Alignment with the scenario, significant handovers and participants' responses. This function spans every phase; it does not begin after Respond.
ImproveTurn experience into improvementThe debrief connects evidence with next actions.
What happens
The White Team leads the review with participants. Strengths, friction and gaps are discussed to define actions, priorities and responsibilities.
What is prepared
An improvement plan and the areas to test in a subsequent exercise. The next test observes the effect of the actions introduced.
The sequence is not a timetable. Duration, intensity and progression depend on the scenario. Observation, communication and coordination continue throughout and may overlap different activities.
Observe and measure
Readiness
leaves evidence.
The exercise does not end with the final event. The response is observed and documented to understand where it holds, where it slows and where coordination needs strengthening.
- Detection
- Signals, recognition and initial understanding.
- Escalation
- Observed timings, thresholds and involvement of the appropriate functions.
- Decision-making
- Priorities, responsibilities and the quality of choices under pressure.
- Containment
- The ability to limit impact and propagation within the exercise environment.
- Coordination
- Collaboration between Cyber, IT, OT, leadership and crisis functions.
- Recovery & Communications
- Recovery, continuity and stakeholder communications.
From behaviour
to evidence.
- Event
- What was introduced into the scenario?
- Available information
- What signals were available to participants?
- Decision and action
- Who decided, on what basis and with what response?
- Observed effect
- What changed as the exercise developed?
A framework for reviewing observations, not telemetry or client results.
Timings and behaviours are interpreted in the context of the exercise. Its findings are neither a guarantee of future performance nor a universal readiness score.
After the exercise
The debrief turns
simulation into capability.
Attack, progression, behaviour and decisions are reviewed together. The White Team guides the review to build a practical plan and prepare the next cycle.
Reviewing the exercise
Reconstruct events.
Identify where to act.
- Evidence
- What happened and which observations support that account.
- Strengths and gaps
- Where the response held and where friction or operational weaknesses emerged.
- Discussion
- How participants interpret events, constraints and decisions.
Improvement plan
Define the actions.
Prepare the next test.
- Actions and priorities
- Which areas to strengthen and in what order.
- Responsibility
- Who is responsible for taking forward the actions identified in the review.
- Further validation
- Which capabilities to test again to observe improvement.
Technology, decisions, continuity
One exercise.
Different perspectives on the response.
What matters depends on the observer’s responsibility. These perspectives complement one another: an effective technical response must also be understood by those coordinating the crisis and protecting continuity.
One exercise · two levels of response
The same event. Responsibilities that must connect.
Technical capabilities
Understand the event.
Act on the systems.
Recognising signals, analysing, containing and restoring the systems involved.
- Evidence analysis and investigation
- Actions on the IT and OT / ICS systems in scope
- Dependencies and recovery conditions
Cyber · SOC · Incident Response · IT · OT
Explore the technical responseBusiness responsibilities
Decide the priorities.
Coordinate the consequences.
Decisions, continuity and trust: escalation and coordination with incomplete information.
- Decision-making mandates and operational priorities
- Legal assessment and crisis management
- Communications and stakeholders
C-Level · Crisis Team · Operations · Legal · Communications
Executive & Crisis ManagementCyber Crisis ReadinessDesign the exercise
Put the response
that matters to the test.
Start with your context, objectives and the functions you need to exercise. CyberUP designs the scenario and builds an exercise aligned with the organisation’s operational reality.
A conversation with our team
Which response
do you need to test?
The scenario, participating functions, environment and capabilities to test are the points to establish.
The first conversation defines the scope of the exercise.
Write to us
Email us directly or fill in the form below: we’ll get back to you.
Email us: info@cyberupinstitute.com
Your current interest: How the Cyber Arena works