Business leaders handle the communications and governance side of a cyber attack far better than the technical work of containing it and recovering safely, according to research from Databarracks.
The business continuity and IT resilience firm analysed 2,117 scored responses from 303 participants across 147 organisations who took part in its Anatomy of a Crisis wargames. The exercises simulate a cyber attack closely modelled on real incidents, such as those at M&S, Royal Mail and the British Library. Participants make decisions on containment, communications, operational continuity and recovery, and are scored in real time.
On average, scores for governance and communications decisions were 17 points higher than for technical execution. The three lowest-scoring areas were containing the attack while keeping essential services running, operating when systems could not be trusted, and recovering cleanly.
Most participants chose a sensible first action but stopped there. In the containment decision, 66% called for isolating affected systems. But only 7% gave a risk-based rationale for what to shut down or keep running, 10% explicitly considered protecting critical systems, and 20% mentioned preserving forensic evidence before systems were wiped or rebuilt.
Operating when systems could not be trusted was the lowest-scoring area. Only 11% of responses explicitly assumed compromise and moved to clean communication channels, and just 8% mentioned verifying identity before trusting instructions.
“Moving to another messaging application does not make crisis communications secure,” said Chris Butler, resilience director at Databarracks, who runs the wargames.
Butler said attackers may already have access to corporate accounts, contact directories or compromised identities. Crisis teams need pre-agreed clean channels, trusted contact details, identity checks and a decision log set up and rehearsed in advance.
At the recovery stage, only 11% of responses mentioned restoring from backups that had been checked and confirmed as clean. Identity services and privileged access were frequently missing from recovery priorities. Butler warned that restoring applications into an environment with compromised accounts can let the attacker straight back in.
No sector had a clear advantage. Among sectors with at least 10 participants, average scores were within 9 points of each other, with insurance, banking, technology, retail, utilities and the public sector all close to the average.
Professional roles differed more. Risk teams were strongest at prioritising recovery and assigning board ownership. Technology staff brought forensic discipline and backup verification. Business continuity professionals set up command structures fastest. Butler said the findings supported building and rehearsing cross-functional crisis teams.
The participants chose to attend Databarracks’s wargames, and the scores reflect decisions in a simulation rather than real incidents.
The recovery findings speak directly to cyber underwriting. Insurers increasingly ask about backup practices, privileged access controls and incident response plans. A business that restores from unverified backups, or reconnects services before securing identity, risks reinfection, which can extend business interruption and increase the size of a claim.
The findings also echo this month’s Marsh research on retailers, which found that recovery capability, not the volume of controls bought, is where cyber spending most often falls short.
For brokers, the research is a prompt to look beyond whether clients have an incident response plan to whether they have rehearsed it. Clients should know how they would communicate if corporate systems were compromised, and how they would confirm backups are clean before restoring. Cyber policies often provide incident response support to help, but it works best when the client’s own crisis team is ready to act on it.
