4 min read
Crisis simulation: pressure changes decisions
Around a table, the IT manager of a 250-person services company said it without hesitation: faced with ransomware, he isolates the file server within the first ten minutes. A few weeks later, the same team replays the same scenario in a simulation, with a clock, a mailbox, a chat and a phone. At the twelfth minute, nine messages have arrived, two calls have rung, and the server is still connected; it will not be isolated until the forty-first. The company is fictional, but the situation will be familiar to anyone who has lived through an incident: between “what would you do?” and “what do you do when fifteen messages arrive at once?” there is a distance that discussion does not measure and that crisis simulation lets you cover.
Discussing is not deciding
In a discussion, everyone can think, ask for a clarification, wait for the next item on the agenda. The IT manager in our example is therefore right, at his table: isolating the server is the right answer, and he gives it quickly because nothing stops him from giving it quickly. Six people are not writing to him at the same time, and the question comes with no visible consequence.
In a crisis, the clock keeps running, and that is what changes the nature of the decision. Not deciding becomes a decision in its own right: the statement that does not go out, the connection that stays open while people debate, the call to the executive put off because the hour does not seem right. None of these omissions is chosen. They pile up because attention is taken elsewhere, and added together they weigh more than the spectacular decision that will be remembered. A simulation puts that constraint on the table: events land at fixed times, whether the group is ready or not.
What a simulation adds
Let us go back to the twelfth minute. Time, first: the schedule of events is the simulation’s, not the group’s comfortable pace. Several channels, next: an email from an employee whose screen displays a ransom demand, an instant message from the finance director worried about payroll, a support ticket, a customer’s call. This information arrives at the same time, and it sometimes contradicts itself: one person believes in a failure, another in an attack. It is incomplete, as in reality, where you decide before you know.
Consequences come next, and they are what a discussion lacks most. When the IT manager finally isolates the server, production stops, and the operations manager calls, furious, on the landline. Then you have to explain, arbitrate, perhaps restore partially, and meanwhile the journalist who had written a quarter of an hour earlier is still waiting for an answer. All the roles play at the same time, including those that often exist only on paper, such as the data protection officer or the lawyer, who turn out not to have been told anything.
What you learn
In those forty minutes or so, the team learns several things no discussion would have taught it. It learns to prioritize when everything seems urgent: the server first, or payroll, or the customer losing patience? It learns to communicate internally, to customers and to the authorities while legal deadlines are running, and to know when to escalate information to management rather than keep it. It also learns to record its decisions, who decided what, when and why, a habit that pressure makes you forget the first time. That record will serve the analysis that follows, but also the authorities, insurers and customers who will one day ask for an account.
Measure rather than feel, and complement the tabletop exercise
At the end of the exercise, the group has an impression, and the impression is rarely reliable: “it went rather well” is a feeling. A simulation can record facts instead: the time elapsed before detection, before the first decision, before notification, and here the forty-one minutes before the server was isolated. From one exercise to the next, those measures show whether the team is improving, which no memory can tell you, and a report based on traces does not depend on what the facilitator had time to write down.
The tabletop exercise and the simulation are not opposed. The first is for discussing the plan and building a shared understanding; the second is for rehearsing action under pressure. Start with the first, add the second, then replay it with a harder scenario. That is what UnderCrisis does: the platform generates an exercise from your organization’s context, plays it in a simulated mailbox, chat, service desk and phone, traces every decision and delivers a report with an action plan.