Adversary Simulation and Supervised Exercises

Organizations train for fire with fire drills, not with real fires. In cybersecurity, supervised exercises play the same role: they let people practice their response to an attack in controlled conditions. In this lesson you will meet the main exercise formats, understand why the framework around them matters more than the technique, and see where you, as an apprentice, can safely participate.

A family of exercises

"Simulating an adversary" covers many different activities, from a conversation around a table to a multi-week operation. Here are the main formats, from least to most intrusive.

Tabletop exercises

A group meets in a room and works through a scenario described step by step by a facilitator: "At 9:12 a.m., employees report that files have strange extensions. What do you do?" No computers are attacked. Participants from IT, management, legal and communications discuss who decides what, whom to call and what to tell customers. Tabletops are cheap and reveal gaps in decisions and communication, which are often bigger than technical gaps.

Technical drills in a lab or cyber range

A cyber range is a dedicated, isolated environment that imitates a real network. Teams can attack or defend without risk to real systems. Ranges are used for training analysts, testing tools and practicing incident response. Several training platforms offer a simplified form of this.

Automated adversary emulation

Some tools run predefined, safe, documented behaviors on test systems to check whether defenses react. These are used in purple team sessions, as seen in the previous lesson. They are valuable when used on systems you are authorized to test and according to a plan; they are not a toy for production machines.

Full red team exercises

The scenario-based, goal-driven operation described in lesson 3.1, run against the real organization with real defenders, often over weeks. It requires the heaviest preparation and the strongest safeguards.

Phishing and awareness simulations

Many companies send harmless simulated phishing messages to measure and train employee vigilance. Even these need a framework: management approval, consultation of staff representatives where the law requires it, no humiliation of people who click, and compliance with data protection rules. The aim is to teach, not to catch out.

Capture the flag (CTF)

CTFs are competitions in which participants solve security challenges on purpose-built systems to find "flags". Some are jeopardy-style (independent puzzles), others are attack-and-defense (teams protect their own system while attacking others) or scenario based. They are a legal, enjoyable and well-recognized way to build skills, and you will use them for your portfolio in chapter 6.

Building a safe exercise: a checklist

1. Purpose: what do we want to learn? Detection? Communication? Technical recovery?
2. Authorization: written, signed, with names, dates and systems.
3. Scope and exclusions: explicit lists, including critical systems that must never be touched (medical devices, industrial controllers, emergency services).
4. Rules of engagement: allowed techniques, forbidden ones, hours, how to handle accidental discoveries of personal data.
5. Safety mechanisms: a stop word or procedure, emergency contacts, backups of systems before the exercise, a rollback plan.
6. Data handling: what is recorded, where it is stored, who sees it, when it is deleted.
7. Communications: who is informed, who is not, how real incidents are separated from simulated ones.
8. Evaluation: criteria agreed in advance, so that the exercise does not become a judgment of individuals.
9. Debrief and follow-up: a meeting, a written report and a tracked list of actions.

Why exercises go wrong

• Unclear scope: the team touches a partner's system or a hosted service they do not control.
• Surprise for real responders: a real incident response is launched, a provider is alerted, or the police are called because nobody told the right person.
• Accidental impact: a technique crashes a fragile system in production.
• Human harm: a phishing simulation is too realistic or too personal, and employees feel manipulated or humiliated.
• No follow-up: a report is written and shelved, and the same gaps remain a year later.

Most of these problems are prevented by paper and conversation, not by technology.

In France and Europe: a quick orientation

In France, security audit providers can be qualified by ANSSI, under a qualification scheme for information systems security audit providers, which is one reason organizations ask for that label for certain sensitive tests. ANSSI (cyber.gouv.fr) also publishes guidance on cyber crisis exercises. At a European level, new regulations increase the expectation that important organizations test their resilience. Details change over time, so always check the current texts on official sources such as legifrance.gouv.fr or cyber.gouv.fr instead of relying on memory.

Ethics in a sentence

Ask yourself three questions before any exercise: "Do I have permission, in writing? Do I know exactly where my limits are? Could someone be harmed, and have I done everything to prevent it?" If any answer is "no" or "I am not sure", stop and ask.

Where an apprentice can start

• Join a beginner-friendly CTF event, alone or in a team, and read the rules carefully.
• Complete guided rooms and machines on legal training platforms.
• Volunteer to help in a school or association tabletop exercise.
• Run a two-person purple exercise in your own lab, as in the previous lesson.

Your turn: design a tabletop

Write a one-page tabletop exercise for a fictional small company, "LabCorp", with 40 employees. The scenario: an employee reports that their files cannot be opened and a message demands payment. Write the scenario introduction, three "injects" (new pieces of information given during the exercise) and five discussion questions.

See a solution

Introduction: Monday, 9:10 a.m. An accountant reports that files on her computer show strange extensions and a message demanding a payment. She is worried, because the same shared folders are used by the whole accounting team.

Injects:

1. 9:30 a.m.: two more employees report the same problem; the shared folder is affected.
2. 10:15 a.m.: the IT administrator discovers that the most recent backup is stored on a disk connected to the same network.
3. 11:00 a.m.: a customer calls asking why they received a strange message from your address.

Discussion questions:

1. Who is in charge of the incident, and who decides to isolate machines?
2. What do you do first: disconnect, investigate or call someone? In what order, and why?
3. How do you check whether the backups can be trusted?
4. What do you say to customers and employees, and who says it?
5. Which external parties should you contact (for example national resources such as cybermalveillance.gouv.fr and ANSSI), and are there legal obligations to report?

No computer is touched in the exercise: the value is in the decisions.

Portfolio step

Add tabletop-exercise.md to 03-red-blue with your scenario. It shows that you understand not only technology but also the human and organizational side of incidents, which employers value highly.

You have now seen both sides. In chapter 4 you will dive into how defenders actually detect and respond to an intrusion.