Why Cybersecurity Drills Run Smoothly But Real Incidents Stall: The Collaboration Gap

Scripts Give a Starting Point; Real Incidents Give Questions First

A scripted drill typically begins with a clear event prompt: participants know the problem category and expect further injects. In a real incident, the first clue may be a vague alert, a user complaint, or an unexplained discrepancy between two systems. The on‑call engineer faces not "which step next" but "is this even an incident and what is the impact?" This difference shifts the entire collaboration rhythm — technical staff want more evidence, business owners fear downtime, managers need to decide when to escalate — and those reasonable questions rarely resolve in the same minute.

The Decisions at the Boundary Are Where Things Get Stuck

Consider a fictional scenario: an online service shows intermittent anomalies; the monitoring platform only shows request‑volume changes on some interfaces. The technical team suspects a configuration issue but cannot rule out a security breach. The business team wants to restore service immediately; the security team worries that changes will destroy forensic evidence. At this point the plan’s three words — "assess, contain, recover" — expand into a chain of interdependent questions: who has authority to pause an interface? Who confirms business impact? What information is sufficient for external reporting? What evidence must be preserved before recovery? If a drill writes those answers into inject cards, the exercise flows smoothly but only tests execution speed. The real test is whether the team can articulate the uncertainty and keep decisions moving forward when answers are missing.

Finishing on Time Does Not Mean You Found the Problems

China’s National Cybersecurity Incident Emergency Plan states that drills aim to test and improve plans and raise practical capability, linking reporting, response, investigation, and assessment in one chain. NIST’s 2025 revision of SP 800‑61 (Rev.3) similarly stresses that incident response must be integrated into daily cybersecurity risk management, not treated as a standalone phase. Therefore, drill evaluation should not stop at "did we complete the process on schedule." More useful observations are the pauses: where information distorted in handoff, which step lacked a decision‑maker, which recovery action would compromise later investigation, which contact number was already dead. The U.S. CISA tabletop exercise packages (CTEP) include not only scenario scripts but also participant feedback and after‑action report templates — a design that treats drills as opportunities to uncover coordination gaps rather than to rehearse a polished routine.

Good Drills Should Allow "I Don’t Know" to Appear

The core gap between drills and real incidents is not the speed of technical actions but the collaboration deficit when information is incomplete. A more realistic drill does not need a dramatized crisis; it can start with a single incomplete clue, let participants offer divergent judgments, and force real trade‑offs among business impact, evidence preservation, and recovery timing. The record should capture not only "how many minutes" but "what we knew, what we didn’t know, and who decided on what basis." When those questions become visible in the exercise, the plan has a chance to evolve from a complete document into a genuine collaboration agreement. Cybersecurity incidents do not follow a script. The most valuable drill outcome may not be proving everyone knows the script, but discovering the minutes the script never covered.

Sources and References

Central Cyberspace Affairs Office: National Cybersecurity Incident Emergency Plan , provisions on incident reporting, investigation, assessment, and drill purposes. https://www.cac.gov.cn/2017-06/27/c_1121220113.htm U.S. National Institute of Standards and Technology (NIST): SP 800‑61 Rev.3 (2025) — incident response must be integrated into organizational cybersecurity risk management.

https://www.nist.gov/news-events/news/2025/04/nist-revises-sp-800-61-incident-response-recommendations-and-considerations

U.S. Cybersecurity and Infrastructure Security Agency (CISA): CTEP tabletop exercise materials including roles, feedback, and after‑action report templates.

https://www.cisa.gov/resources-tools/resources/ctep-package-documents