Cyber exercises are everywhere. Boards are convening tabletop sessions. National and sector-wide drills are expanding. Red and blue teams are being put under pressure. Crisis simulations are appearing in resilience programmes that did not exist a few years ago.

This is progress. It reflects an overdue recognition that resilience cannot be established by a policy, a compliance map or a maturity score alone.

But fashion creates its own risk: activity can be mistaken for evidence. For CISOs, heads of infrastructure and operations, SOC and incident-response leaders, resilience owners, and critical-infrastructure operational and safety stakeholders, this paper offers a practical method for separating the two: follow one consequence-led scenario from executive decision to technical response & recovery, and treat remediation and re-test as part of the exercise. A polished, well-attended session may still reveal little about whether an organization can absorb a real attack. Exercises are fashionable. Failure is not.

That is what makes Gartner’s June 2026 Maverick Insights note so provocative – and so useful.

If every exercise succeeds, the organization may be rehearsing confidence rather than testing resilience.

The provocation is about evidence, not vocabulary

The Gartner Maverick note should be read fairly. It is deliberately contrarian research, explicitly intended to challenge prevailing wisdom rather than to represent a conventional consensus. And it is not arguing that cyber resilience is unimportant.

Its challenge is more uncomfortable: cyber resilience is not necessarily a new discipline beyond cybersecurity. It is the observable result of cybersecurity, cyber-risk management, continuity and recovery executed properly. A separate resilience programme can become a fresh label for old work – segmentation, identity protection, recovery ownership, tested backups and threat-informed prioritization – which was already understood, funded or deferred.

An organization does not manufacture resilience in the middle of an attack. The attack reveals decisions made much earlier: which services were treated as critical, which attack paths remained open, who owned recovery, whether dependencies were understood and whether restoration had ever been practiced under pressure.

The Gartner note’s most valuable challenge is therefore not semantic. It is evidential. Too many resilience tests are institutionally comfortable because meaningful failure carries a price. If an exercise shows that recovery does not work, a risk owner must act, a budget must move or someone must formally accept the exposure. A reassuring exercise produces a board update. An honest one may force a decision.

That is the difference between resilience work and resilience theatre.

An exercise can be useful without being assurance

The word exercise describes an event, not the strength of the evidence it produces. Before judging an exercise, organizations should be explicit about its purpose.

• A learning exercise builds understanding. Participants may be briefed, coached and given time to prepare. Success means they leave better able to perform their roles.
• A rehearsal tests coordination: authority, escalation, communications, hand-offs, dependencies and the sequence of decisions. Success means the organization can execute a known process coherently.
• An assurance exercise asks whether a defined capability meets explicit criteria under specified conditions. Success must be supported by observable behaviour and evidence, not only by participant confidence.
• An adversarial validation exercise deliberately challenges assumptions, allows unexpected paths and treats a consequential failure as a valuable result – provided it leads to remediation and re-testing.

None of these purposes is inherently superior. The category error is to complete a learning exercise and present it as proof of operational capability.

Tabletop is not the problem

A separate 2026 Gartner infographic describes tabletop exercises as an effective way to test response strategies and offers practical advice on executive participation, scenario choice, business impact, third-party dependencies and after-action learning.2 Its recommendations make sense for a learning or decision-rehearsal objective: prepare participants, avoid overwhelming executives with technical detail and focus the discussion on decisions that matter.

The same infographic also shows where the assurance gap begins. In its survey of 75 CISOs, 47% ranked simulating a real-world incident among their three largest tabletop challenges, while 39% did the same for measuring effectiveness. These figures do not prove why the problem exists, but they identify the difficult territory: realism and measurement.

A well-designed tabletop can reveal whether leaders understand their priorities; whether authority is clear; whether legal, communications, operational and technical teams know when to engage; and whether critical third parties have been considered. It can expose contradictions that no security tool will find.

But it has a real ceiling.

Turning off laptops and phones can create a useful decision constraint. It does not prove that alternative communications will remain available during a real identity or directory compromise. Discussing segmentation does not demonstrate that it will contain lateral movement. Walking through recovery does not show that backups are intact, dependencies are mapped, restored systems are trustworthy or the service can return at the required capacity.

A tabletop can test the quality of a decision. It cannot prove that the system will obey it.

The response should not be to discard tabletop exercises. It should be to stop asking them to provide evidence they cannot produce alone.

One scenario, several layers of proof

The mature model is not tabletop versus cyber range. It is one consequence-led scenario moving through a connected exercise continuum. Each layer answers a different question and contributes a different kind of proof:

1. Executive tabletop: Can leaders set priorities, exercise authority, make business trade-offs and coordinate communications and external dependencies?
2. Functional or command exercise: Can teams execute procedures and hand-offs while operating with incomplete information, degraded communications and time pressure?
3. Instrumented cyber-range exercise: Can people, processes, tools and controls detect, investigate, contain and respond to safely emulated adversary activity in a representative environment?
4. Recovery and controlled operational validation: Can the organization restore the affected service, validate integrity and capacity, and meet the recovery objective under appropriately governed conditions?
5. Remediation and re-test: Did the failed assumption produce a changed decision or capability – and can the improvement survive the same challenge a second time?

The important design principle is connection. Executive choices should create observable operational consequences. Technical discoveries should force business decisions. Recovery should be performed, not narrated. The same critical service, threat path and consequence should follow the exercise from the boardroom into the operational environment and back again. Evidence should accumulate across all the layers: decision records, telemetry, control performance, recovery results, assigned actions and retest outcomes.

Three takeaways: 

1) match the exercise to the evidence required

2) connect executive decisions to technical consequences

3) finish only when remediation survives re-test.

Not every tabletop needs to become a large live exercise. The level of validation should be proportional to the consequence being tested. But assumptions protecting a critical service should not remain permanently protected by discussion.

Gold Eagle makes the same point at national scale. Announced by the White House on 14th July 2026, the initiative is intended to coordinate vulnerability work across federal agencies – including Treasury, DHS/CISA and the Department of Defense / War (DoD / DoW) – critical-infrastructure operators, open-source maintainers, frontier AI developers and industry partners.9 Gartner cautions that the initiative is still at an early stage and that its governance and operational effectiveness remain unproven. Its relevance here is therefore the model, not a claim of success.9 That model shifts attention from finding more weaknesses to validating exploitability, prioritizing impact, assigning responsibility, coordinating remediation and verifying that the correction works without creating unintended functional effects.9,10 

The parallel for exercises is direct: finding a gap is only the start. The exercise produces resilience evidence only when the weakness is owned, corrected and challenged again.

OT makes the distinction physical

Operational technology makes this argument impossible to treat as an abstract debate.

In enterprise IT, a cyber incident may compromise data, identities, systems and services. In OT and industrial control environments, it may also affect a physical process, equipment, product quality, the environment and human safety. NIST’s OT security guidance stresses that digital and physical risk are intertwined, that safety directly shapes engineering and operational decisions, and that changes should be tested before deployment where operational impact is possible.4

No responsible operator should turn a live production plant into an unrestricted adversary laboratory. That legitimate constraint explains some reliance on tabletop exercises. It does not justify ending validation at the table.

The right answer is graduated fidelity within an explicit safety envelope.

NIST makes the bridge explicit: organizations should consider tabletop exercises or simulations when they need to reduce assessment impact on production OT, and they should use automated assessment tools carefully enough to avoid adversely affecting the system.4 Safety constrains where and how technical validation occurs; it does not remove the need for it.

An OT tabletop can clarify authority among operations, engineering, functional safety, IT, security, vendors and executive management. It can explore decisions around plant isolation, loss of view or control, remote-access compromise, manual operation, production shutdown and public or regulatory communications. The US Cybersecurity and Infrastructure Security Agency (CISA) has specifically recommended discussion-based exercises involving loss-of-visibility and loss-of-control scenarios in industrial environments.6

Selected assumptions can then move into an isolated, representative environment. Depending on the objective, this may combine virtualized control networks, emulated or simulated PLC, HMI and SCADA behaviour, historians, engineering workstations, remote-access paths, security monitoring and the necessary enterprise dependencies. Where justified, representative hardware or hardware-in-the-loop can add to fidelity. NIST’s control catalogue for OT includes incident-response training using simulated events and automated training environments, alongside incident-response testing.4

Fidelity must be declared rather than assumed. A cyber range is not automatically a perfect digital twin, and a visually convincing replica is not necessarily operationally meaningful. The environment should reproduce the dependencies, behaviours and decision consequences relevant to the test – and be candid about what it does not reproduce.

Consider one connected scenario: a compromised third-party identity enables activity across an IT-OT boundary and creates loss of reliable process visibility. Executives must decide whether to isolate a site or accept degraded operation. The SOC must detect and investigate the cross-boundary activity. OT engineers must distinguish malicious manipulation from equipment failure. Operators may need to move to manual or safe-state procedures. Vendor access and communications must be coordinated. Recovery teams must restore trusted configurations and return the process to service in the correct operational sequence.

Recovery does not end when a server boots. NIST places human and environmental safety ahead of restarting impaired OT operations.4 The exercise must therefore validate the state of the process, the integrity of control logic and configurations, the restoration sequence and the authority for a safe return to service.

The useful measures are no longer exercise attendance or the number of injects delivered. They include detection and escalation time, decision latency, containment without creating a less safe condition, ability to sustain authorized degraded operation, integrity of controller logic and engineering configurations, restoration sequence, recovery time and successful retest.

In OT a technically successful containment action can still be an operational or safety failure. That is precisely why cyber defenders, engineers, operators and safety specialists must exercise together. MITRE ATT&CK for ICS can inform credible adversary behaviours, but operational consequences and safe response criteria must come from the asset owner and engineering context.7

In OT the choice is not realism or safety. It is about building enough isolated fidelity to learn without endangering operations.

A category gap, not a platform vacuum

The evidence does not support a simple platform-vacuum explanation. The Gartner Maverick note critiques execution and accountability, while the tabletop infographic describes challenges within one exercise format; neither is a market assessment.

Platforms and operating models plainly exist. CISA spans discussion-based through large-scale operations-based exercises; Idaho National Laboratory uses immersive IT-OT red-versus-blue environments; and Gartner Peer Insights lists cyber-range and simulation offerings within a broader digital-learning category.3,5,8 That classification is suggestive, not conclusive.

The harder gap is orchestration: tabletops, cyber ranges, recovery tests and OT assurance often sit under different owners, budgets and evidence models. A platform cannot compensate for weak scenario design, insufficient fidelity or reluctance to expose failure. The gap is therefore orchestration, access and integration – not simply technology availability.

OT adds a genuine availability and maturity constraint. Representative testing may require process models, industrial protocols, vendor-specific logic, controllers, safety boundaries and specialized engineering support. A generic training lab will not automatically provide assurance for a particular plant or process.

Count corrections, not exercises

Exercise count, attendance, scenario novelty and the length of the after-action report (AAR) are activity metrics. They do not establish resilience. A more useful measure is the time from observed failure to accountable, verified correction.

Gartner’s August 2026 research on legacy systems sharpens the same accountability test. It recommends combining exploitation evidence, predicted likelihood of exploitation, exposure and business criticality rather than prioritization by severity alone; giving material exceptions an accountable owner, compensating controls, an expiry date and explicit acceptance authority; and measuring treatment time and remediation progress.11 These are correction metrics. Exercise attendance is not.

The questions that matter are more demanding:

1. Which assumption failed?
2. Which decision changed?
3. Which attack path or dependency was corrected?
4. Did recovery work under pressure?
5. Was the issue assigned, funded and remediated?
6. Did the correction survive a retest?

Failure discovered during an exercise is not the opposite of resilience. It is one of the most valuable outputs a resilience programme can produce. Failure found in a safe exercise is still under the organization’s control. Failure found first by an adversary is not.

Gartner’s Maverick argument is useful because it strips away the comfort of the new label. Cyber resilience is not created by describing resilience more convincingly. Nor is it proven because an exercise concluded successfully.

Choose one critical service or industrial process, one consequence the organization cannot absorb and one plausible attack path. Begin with leaders at the table. Continue with teams and systems in a safe, representative environment. Finish only when the correction has survived a second test.

Exercises are fashionable. Failure is not. That is exactly why organizations need environments in which failure can be safe, observable and useful.

A cyber range is not another resilience framework. It is where the framework is forced to meet consequences.

Learn more about CYBER RANGES OT Worlds here.