Wargame findings
Business leaders handle the communications and governance side of a cyber attack better than the technical work of containing it and recovering safely, according to research from Databarracks. The firm analysed 2,117 scored responses from 303 participants across 147 organisations in its Anatomy of a Crisis wargames, which simulate real-world cyber incidents. On average, scores for governance and communications decisions were 17 points higher than for technical execution. The three lowest-scoring areas were containing the attack while keeping essential services running, operating when systems could not be trusted, and recovering cleanly. While 66% of participants called for isolating affected systems during containment decisions, only 7% gave a risk-based rationale for what to shut down, 10% considered protecting critical systems, and 20% mentioned preserving forensic evidence. Operating when systems could not be trusted was the lowest-scoring category, with only 11% of responses assuming compromise and moving to clean communication channels, and 8% verifying identity before trusting instructions. At the recovery stage, only 11% mentioned restoring from backups verified as clean.
Implications for insurers and brokers
Databarracks resilience director Chris Butler noted that restoring applications into an environment with compromised accounts can allow attackers back in. Average scores across sectors including insurance, banking, technology, retail, utilities and the public sector remained within nine points of each other. The findings relate to simulation decisions rather than live incidents. For cyber underwriters, the research underlines the importance of backup practices, privileged access controls and incident response plans when evaluating risks. Brokers can use the findings to prompt clients to test how they would communicate during a system compromise and how they would confirm backups are clean before restoring.