National cyber exercises should test decisions, not theatre.

Britain’s planned large-scale home-defence exercise offers a useful reminder for every organization: cyber resilience is demonstrated through coordinated performance under uncertainty, not through the existence of a response plan.

Reuters reported on 14 July that Britain plans a major exercise for 2027 covering hybrid threats including cyberattacks, disinformation, sabotage, and critical-infrastructure disruption. The multi-agency scope matters because real incidents rarely respect organizational boundaries.

What a serious exercise should expose

An effective scenario should force trade-offs. Leaders may need to preserve an essential service while forensic teams seek containment; communicate publicly while attribution remains uncertain; share indicators while protecting sensitive evidence; or restore systems before the full intrusion path is known.

The exercise should capture who made each consequential decision, what information was available, what assumptions were used, and what control or authority enabled the action. That record is assurance evidence and a foundation for improvement.

Design principles

• Test degraded communications and unavailable decision-makers.
• Introduce conflicting reports and uncertain attribution.
• Include cyber, physical, supplier, information, and public-safety consequences.
• Measure decision latency, escalation quality, service impact, and recovery integrity.
• Track corrective actions to verified closure after the exercise.

Avoiding exercise theatre

Participants should not know every inject in advance. Success should not mean completing a scripted sequence. A mature exercise surfaces control gaps, ambiguous authority, weak evidence, and dependencies that were previously invisible. A comfortable exercise may produce confidence; a demanding one produces learning.