Cyber Range Exercises: From Technical Drills to Full-Spectrum Crisis Simulations

Cyber range exercises matter because they are the only reliable way to validate whether an organisation can actually respond to a cyber incident -- not in theory, but under pressure. Written policies and documented procedures are necessary but insufficient. Until people have been tested under realistic conditions, you cannot know whether your incident response plan will survive contact with reality.

Regulatory frameworks increasingly mandate this testing. The NIS2 Directive requires essential and important entities to conduct regular security testing, including exercises that validate incident response capabilities. DORA (Digital Operational Resilience Act) goes further, mandating threat-led penetration testing (TLPT) for significant financial entities and requiring that ICT risk management frameworks be validated through regular testing. ISO 27001, the international standard for information security management, expects organisations to test their incident response and business continuity plans at planned intervals.

Beyond compliance, exercises reveal the gaps that audits miss. An audit can verify that an incident response plan exists and contains the right sections. An exercise reveals that nobody knows who has the authority to shut down a production system, that the communications team has never drafted a breach notification under time pressure, or that the legal team does not know the CNPD notification deadline is 72 hours under GDPR and 24 hours for early warning under NIS2. These are the gaps that cost organisations millions when a real incident occurs.

Exercises also build cross-functional relationships that prove critical during real incidents. When a ransomware attack hits, the CISO needs to coordinate simultaneously with IT operations, legal counsel, communications, HR, executive leadership, and potentially regulators and law enforcement. If these people have never worked together under pressure, the real incident is the worst possible time to start building those relationships. Regular exercises create the trust, shared vocabulary, and established communication channels that enable effective crisis response.

Most cyber range providers focus exclusively on the technical dimension of incident response: SOC analysts hunting indicators of compromise in a SIEM, incident responders executing containment procedures, forensic analysts imaging drives. These technical skills are essential, but they represent only one layer of what happens during a real cyber crisis. When a ransomware attack encrypts your production environment, the technical response is running in parallel with a dozen other critical workstreams that most exercises never touch.

Consider what actually happens in the first hours of a major cyber incident. The CISO briefs the CEO and board, who must decide whether to pay a ransom, how much operational disruption to accept, and what to communicate to shareholders. Legal counsel is calculating GDPR notification deadlines (72 hours to the CNPD), assessing contractual obligations to clients, and evaluating potential personal liability for directors under NIS2. The communications team is drafting press statements while fielding calls from journalists who have already heard rumours. HR is managing employee anxiety and access revocation for compromised accounts. The procurement team is engaging emergency vendors. Regulator notification workflows are being activated. Insurance claims are being prepared. And all of this is happening simultaneously, under extreme time pressure, with incomplete information.

The full-spectrum approach replicates this reality. In an ObsidianCorps full-spectrum exercise, different crisis cells run in parallel, each receiving their own scenario-appropriate injects. Technical teams see alerts in their SIEM and malware samples on compromised endpoints. Legal counsel receives simulated regulatory correspondence and must calculate notification deadlines. The communications team gets phone calls from simulated journalists and must draft statements in real time. Executives receive pressure from simulated board members and must make decisions with incomplete information. The exercise coordination team manages inject timing to create realistic cascading pressure across all cells.

This is where most organisations discover their real vulnerabilities. Not in their firewall rules or EDR configuration, but in the human layers: the CISO who cannot clearly brief a non-technical board, the legal team that does not know whether DORA or NIS2 notification deadlines apply first, the communications team that has never drafted a breach notification under time pressure, the executive who makes decisions based on incomplete information without acknowledging uncertainty. These soft-skill gaps are invisible to traditional technical exercises but determine the outcome of real crises.

ObsidianCorps designs exercises with injects specifically crafted to surface these gaps. A journalist calls the communications team and asks whether customer data was compromised -- before the forensic team has finished its analysis. The CNPD sends a simulated inquiry requesting details within 48 hours. A major client's CISO calls to ask about supply chain impact. A board member calls the CEO demanding to know why they learned about the incident from the press. These injects create the realistic pressure that separates an exercise from a workshop.