What a cyber exercise costs in the UK

For a first exercise, often yes. The NCSC Exercise in a Box is free, government-funded and a sensible starting point for charities and small businesses. What it cannot provide is an external facilitator, unscripted pressure, an independent assessment, or evidence a regulator or insurer will treat as third-party assurance. If your second run felt the same as your first, you have outgrown it.

Five factors drive cost: how bespoke the scenario is, how many preparation days sit behind the session, whether delivery is remote or on-site, how deep the report is, and whether the audience is executive or technical. Scenario bespoke-ness matters most, a template adapted in an hour costs a fraction of a scenario researched around your real suppliers and attack surface.

Mostly preparation and output. At the lower price you get a real facilitator and a largely templated scenario, usually in a shorter session with a brief write-up. At the higher price you get a scenario built around your actual organisation, timed injects that escalate, timestamped decision capture, and a board-ready report with framework-mapped evidence. Both are legitimate purchases for different jobs.

You can self-facilitate, and it is a reasonable way to start. The limitation is that an internal facilitator knows the answers and has a stake in the outcome, which makes it hard to let a senior colleague sit in productive silence, and those silences are where the learning happens. A common compromise is to self-facilitate short quarterly drills and bring in a facilitator for the annual exercise.

It can, if documented properly. NIST CSF 2.0, ISO/IEC 27035, the NCSC Cyber Assessment Framework, UK GDPR Article 32 and DORA all expect response arrangements to be tested rather than merely written down. A timestamped decision log plus a record of which control areas the scenario exercised is far stronger evidence than a statement that an exercise took place.

At least annually, and again after any major change such as a new system, a merger, a significant supplier or a real near-miss. A stronger pattern is one substantial facilitated exercise a year supported by short quarterly drills, because teams that exercise only once a year tend to have forgotten the lessons by the following summer.