Why annual cyber attack simulation exercises don’t work (and what to do instead)

Most companies treat cyber attack simulations the same way they treat fire drills: one big event a year, check it off the list, and move on.

But true preparedness doesn’t come from a single exercise. It’s built through a mix of training and practice. Awareness training helps people understand what to do; exercises help them experience how it feels to act under pressure.

Like training a muscle, resilience comes from small, repeated efforts that build confidence and memory over time.

In this article, we’ll explore why one-off simulations fall short and how to create a rhythm of learning and practice that’s both realistic and sustainable.

Why one-off exercises fall short

Annual cyber simulations are well-intentioned. They create urgency, bring people together, and reveal vulnerabilities, communication gaps, or unclear roles. As a first step, that’s useful—it helps security managers and teams see where plans break down and where follow-up training is needed.

But an annual simulation is still just that: an event. It measures awareness at a moment in time, not how people will behave when the real pressure hits months later. Once your annual exercise ends, without follow-up practice, the benefits fade quickly.

In other words, the issue isn’t doing one cyber exercise; it’s stopping there. 

A single simulation can serve as a benchmark, but cyber resilience only grows when those lessons turn into continuous learning and follow-up exercises that strengthen what people have learned.

Why one annual exercise isn’t enough:

• We don’t realize how quickly we forget: most people lose around 70% of what they learned within 24 hours. Without follow-up practice, the impact of a yearly simulation evaporates almost immediately, leaving only a vague memory that doesn’t translate into action.

• Cyber threats evolve too quickly: threat actors are constantly adapting, using AI-driven social engineering, deepfake calls, and even malware to bypass controls. A yearly exercise can’t prepare your colleagues for attack scenarios that didn’t even exist when your last incident response plan was written.

• Staff turnover erodes coverage: people leave, new hires join, and roles shift. Without ongoing incident response processes, people may never get exposure to your playbooks or crisis management approach. If cyber preparedness only happens annually, by the time the next exercise arrives, the group facing it could be completely different. 

• Culture isn’t built in a day: security culture is about people feeling ownership of their role in protecting the organization. That sense of responsibility comes from repeated signals and shared experiences. A one-off event, however intense, can’t replace the steady rhythm of smaller, ongoing exercises that normalize security conversations.

What works: recurrent cybersecurity exercises and training

If one-off simulations are snapshots, recurrent training and exercises are the movie. They build confidence and reflexes over time and help teams respond calmly under pressure.

The SANS 2025 Security Awareness Report shows that it takes three to five years for behavior change to take root across an organization, and up to a decade for a culture shift. That shift doesn’t happen through repetition for compliance, but through meaningful opportunities to learn, reflect, and apply lessons in realistic ways.

But let’s be clear: frequency alone doesn’t make learning effective.

Yes, security learning needs to be continuous, relevant, and embedded in daily work rather than an annual event. But training frequency is secondary to what people take away from it.

What really matters is whether they have the space to reflect, adapt, and apply what they’ve learned—whether the experience sticks enough to shape behavior the next time pressure hits.

When training and exercises happen regularly, it strengthens incident response capabilities, making sure that when a real data breach or ransomware attack happens, your response team has already practiced in a safe environment.

Here’s what makes this approach effective:

• Frequent, smaller simulations build “muscle memory”: shorter, repeatable exercises are easier to run and more effective than one overwhelming, large-scale scenario. They give people the chance to practice realistic decisions under pressure, strengthening the reflexes they’ll rely on in a real incident.

• Role-specific training makes it real: Tailored cyber incident response exercises are a hands-on cybersecurity training method that helps your colleagues connect cybersecurity directly to their responsibilities. Finance teams might practice stopping a fraudulent payment, while a CISO or executive group rehearses decision-making in a simulated attack or ransomware scenario. 

Continuous reinforcement keeps security top of mind: sprinkling smaller exercises throughout the year normalizes security conversations. Instead of treating cybersecurity as a one-off annual event, teams start to see it as part of everyday work, building awareness and confidence step by step.

At Secure Practice, we’ve seen how recurring cybersecurity exercises boost confidence, but also how planning them can overwhelm small teams.

PrepJam is our way of lowering that barrier. As a self-service tool for facilitating preparedness exercises, it turns simulations into something quick, interactive, and repeatable. With built-in scenarios, a branching storyline engine, and realistic interactive features like calls or texts, it helps people feel the pressure of a real incident without weeks of preparation on your side.

And because every company is different, we’re constantly evolving PrepJam with feedback from customers:

• Making it role-relevant with content tailored for finance, managers, and IT teams

• Scaling from 10 to 300+ participants, so both small teams and large organizations can train together

• Adding reporting and insights so security managers can understand what happened in the exercise and how best to address it

The technology and its scenarios make it easy for us, facilitators, to keep participants motivated and to create a safe space for them to interact and start conversations around cybersecurity preparedness. PrepJam has been essential for running the awareness campaign Hele Norge Øver.

– Liv Dingsør, General Manager, Digital Norway

We know preparedness isn’t built in a day. That’s why PrepJam is designed to help you see opportunities to practice all year round—whether it’s a quick finance team scenario after spotting a phishing email trend, or a manager-focused session when deepfake calls make the news. 

Our goal is to make learning about and practicing cybersecurity a rhythm rather than a rare event, meeting organizations where they are today and helping them build the strong security culture they want tomorrow.

How to build a realistic rhythm of training and exercises

Cybersecurity practice doesn’t have to be complicated. Think of it as a rhythm—a balanced mix of training and exercises spread throughout the year.

Start by identifying who you’re training and the challenges they face. Then plan realistic sessions: some teams, like incident response, might exercise quarterly; others only once or twice a year. Everyone still benefits from continuous training, but not everyone needs full-scale drills.

Here’s how that can look in a 12-month cycle that stays practical and people-centered.

Quarterly (core response teams)

Run incident response and crisis-management exercises once per quarter. Use tabletop exercises or interactive simulations that stress-test your crisis management and cyber incident response planning:

• Actors: leadership, crisis response teams, IT/security staff

• Objective: rehearse collaboration and stress-test decision-making and communication under pressure

Format: simulate a ransomware outbreak, supply chain attack, or data breach where execs must make fast calls and teams need to coordinate

Twice a year (team-based)

Plan scenario-based exercises for high-risk departments once or twice a year.

• Actors:
  
  Finance: practice spotting and stopping fraudulent invoices
  
  Managers: rehearse handling a deepfake caller posing as the CEO
  
  IT/tech staff: respond to spear-phishing leading to malware infection

• Objective: practice handling incidents relevant to their roles and reinforce role-specific behaviors that directly tie to their responsibilities

• Format: 30–45 min micro-simulations with realistic role dilemmas

Seasonal (context-driven)

Tie exercises to real-world risk peaks:

• Actors: traveling staff, HR during hiring cycles, employees during tax or holiday season

• Objective: build awareness of situational risks that spike at certain times of year

• Format: short, scenario-based injects (fake travel scam email in summer, tax-season phishing in spring, holiday shopping malware in December)

Ongoing (awareness and learning activities)

Between these larger simulations, keep awareness alive through short learning touchpoints: phishing simulations, e-learning modules, or short scenario discussions tied to real-world events. These aren’t exercises in the strict sense, but they keep security knowledge active and prepare people for the next incident.

You can still time these to seasonal risk peaks, but treat them as light-weight awareness activities, not full crisis rehearsals.

Month-by-month rhythm of training and exercises

Not every organization will follow the same schedule, and that’s okay.

Here’s one example of how a balanced rhythm of training and exercises can look across a full year, mixing awareness touchpoints, team-based practice, and quarterly crisis simulations.

Not every activity needs to be a full simulation. Design a schedule that fits how people actually work: core teams might practice quarterly, while others join once or twice a year. Everyone benefits from ongoing training, but only some need regular crisis rehearsals.

The goal isn’t to fill every month, but to create a rhythm that’s sustainable and relevant, keeping learning continuous and practice meaningful across the organization.

PrepJam supports this kind of flexible rhythm. 

Customers told us they wanted to move from “one big annual event” to a series of touchpoints that stay fresh and engaging. That’s why we designed:

• A library of ready-to-use scenarios to make it easy to get started with quarterly or monthly sessions—continuously expanded based on customer needs

• A scenario editor so managers can easily adapt exercises to their own context

• Built-in reporting after each exercise provides actionable insights, helping teams learn quickly and adjust their response

Preparing for NIS2 involves business continuity, executive stakeholder buy-in, preparedness plans—and very much exercising those plans.

– Erlend Andreas Gjære, Secure Practice, CEO and Co-founder

Why this matters for your organization

When training and exercises happen regularly, people stay sharp and security becomes something the organization lives—not something it checks off once a year.

The goal isn’t to make everyone a crisis responder, but to help people understand their role and give key teams space to practice it. Over time, this rhythm turns security from a compliance activity into a shared learning process, building both confidence and capability.

PrepJam helps make that rhythm sustainable, so preparedness becomes part of everyday work.

It lowers the barrier to practice and gives security managers the flexibility to plan exercises that make sense for their size, culture, and time constraints—whether that’s a full incident drill or a short role-based scenario that brings a team together for 30 minutes.

FAQs