Readiness is not established when the plan is written. It is established when people have practiced together often enough, honestly enough, and rigorously enough to act with discipline under pressure. Here is how exercises, training, and lessons learned move cybersecurity readiness from aspiration into practiced organizational competence.

Published in EDPACS (Taylor & Francis), 2026.

Abstract

This article examines the role of structured exercises, disciplined training, and lessons learned programs in advancing cybersecurity readiness across the enterprise. While incident response and recovery capabilities are indispensable during active disruption, their effectiveness depends substantially on the extent to which they have been practiced, evaluated, and refined before a crisis occurs. A mature cybersecurity program therefore requires more than technical controls and documented plans. It requires repeated exercises, transdisciplinary training, realistic command simulations, formal engagement with third party partners, and a disciplined process for converting operational experience into improved readiness. Emphasis is placed on the value of regular Cyber Incident Response Team training, recurring scenario-based exercises, role specific instruction for component leaders and volunteer support personnel, and structured lessons learned sessions that strengthen readiness without imposing undue burden on participants who also carry day to day business responsibilities. This article extends the discussion from restoration and resiliency into the organizational disciplines of exercise design, recurring training, and lessons learned as mechanisms for sustained cybersecurity readiness. It is informed not only by established cybersecurity principles, but also by the author’s extensive firsthand experience in operational cyber leadership across incident response, containment, eradication, restoration, and enterprise readiness activities in complex organizational environments.

“Readiness is not established when the plan is written. Readiness is established when people have practiced together often enough, honestly enough, and rigorously enough that disciplined action becomes possible under pressure.”

Kevin Lynn McLaughlin, PhD

This article extends prior discussion of restoration and resiliency into the organizational disciplines of exercise design, recurring training, and lessons learned as mechanisms for sustained cybersecurity readiness. If restoration demonstrates whether an organization can recover, training demonstrates whether it has prepared itself to do so with coherence, discipline, and institutional steadiness. Readiness, in this sense, is not a static condition created by documentation alone, nor is it the inevitable byproduct of technology investment. It is an organizational capability that must be developed intentionally through repetition, evaluation, correction, and sustained practice over time. Exercise programs test whether command structures function as intended, whether roles are understood, whether communications pathways hold under pressure, and whether technical and nontechnical teams can work through a shared operational framework when uncertainty is high. Recurring training reinforces these capabilities by converting abstract plans into practiced behaviors and by strengthening the trust, familiarity, and command discipline that serious incidents demand. Lessons learned complete the cycle by ensuring that operational experience is not merely observed and archived, but translated into measurable improvements in preparation, decision making, and future execution. Taken together, these disciplines move cybersecurity readiness from the realm of aspiration into the realm of practiced organizational competence.

In mature cybersecurity programs, readiness cannot be assumed merely because policies have been approved, technologies have been implemented, or response procedures and standard operating procedures (SOPs) have been documented. Those elements remain necessary, but they are not sufficient. Under the strain of a serious cyber incident, organizations rarely perform at the level of their plans and SOPs. More often, they perform at the level of their training, their practiced command structure, and the quality of the working relationships they have deliberately built and sustained before the incident begins. Those relationships should not be treated as the product of a single introductory meeting or an isolated coordination session held several years earlier. They must be developed intentionally, reinforced regularly, and maintained over time through recurring interaction, training, exercises, and shared operational experience. Periodic social and professional touchpoints, including occasional breakfast or lunch meetings with key internal partners, third party responders, and other trusted collaborators, can also be valuable because they help build familiarity and trust before those relationships are tested under pressure. Some of these relationship building opportunities may also occur at industry conferences, which can be especially useful because they provide a setting outside the normal office environment and its daily distractions, allowing participants to establish stronger professional bonds and maintain continuity of connection over time. In mature cybersecurity programs, trusted relationships are not static assets. They are living components of readiness that must be cultivated across years if they are to function effectively during a crisis. The same principle of sustained preparation applies to the human demands of extended incident response. Organizations should not assume that every CIRT participant who initially responds will be able to sustain the same level of engagement throughout a prolonged event. Extended incidents create cumulative operational and psychological strain, and research on cybersecurity incident responders has shown substantial burnout associated with workload, limited control, and teamwork challenges (Nepal et al., 2024). For that reason, training, staffing, and command models must be designed in advance with reinforcement, rotation, sustainability, and, where appropriate, cross training across functional areas in mind rather than relying on assumptions of uninterrupted human endurance. Cross training can be especially valuable because it helps preserve continuity when key personnel become unavailable, fatigued, or overextended during prolonged incidents. It also strengthens mutual understanding across the command structure by allowing participants to appreciate the responsibilities, pressures, and information needs of adjacent roles. When applied thoughtfully, such cross training does not eliminate the need for specialized expertise. Rather, it increases organizational adaptability and resilience by ensuring that essential support functions can be reinforced when the incident places sustained demands on the same personnel over time.

A cybersecurity program should be evaluated not only by the sophistication of its preventive controls, but also by the seriousness with which it prepares internal teams, third party partners, and, where possible, trusted federal contacts such as the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) to act together under pressure. Training across these groups is especially valuable because serious incidents often require rapid coordination, aligned communications, evidence preservation, and disciplined command relationships that cannot be built for the first time in the middle of a crisis. At the highest level of maturity, however, this preparation should be understood not merely as cross functional participation, but as a transdisciplinary model of readiness. As Kesler and Liebrock (2025) explain, a transdisciplinary approach goes beyond multidisciplinary and interdisciplinary collaboration by bringing participants together through a shared conceptual framework that integrates discipline specific perspectives, methods, and priorities to address a common problem. In the context of a cybersecurity training program, this distinction is highly important. Technical responders, business leaders, communications professionals, continuity planners, legal advisors, third party specialists, and government partners must do more than attend the same exercise or contribute adjacent expertise. They must learn to think, communicate, and operate through a shared command logic that supports unified decision-making during crisis. This is precisely why transdisciplinary training is so valuable. It reduces fragmentation, strengthens mutual understanding, and prepares the organization to respond through coordinated action rather than parallel activity. In this sense, a mature training program does not simply assemble different stakeholders in the same room. It develops the shared operational framework through which they can act together with greater coherence, trust, and effectiveness when an actual incident occurs (Kesler & Liebrock, 2025).

One of the clearest indicators of an immature cybersecurity program is the assumption that readiness can remain conceptual until a crisis emerges. That assumption is particularly dangerous in cyber incident response, where the opening phase of an event is often characterized by ambiguity, compressed decision timelines, incomplete technical evidence, executive pressure, and significant operational stakes. In this respect, cybersecurity readiness resembles the preparation of a serious team sport more than a purely technical exercise. A team does not become effective on match day simply because the playbook exists or because the players understand their positions in theory. It becomes effective because it has practiced together repeatedly, learned how to communicate under pressure, internalized its assignments, and developed the trust required to act with cohesion when conditions become fast moving and uncertain. Strong teams also learn that belief, discipline, and mutual confidence are not motivational abstractions. They are operational assets developed through repetition, accountability, and shared effort over time. The same principle applies in cyber incident response. A systematic review of cybersecurity training methods found that training generally produces positive effects across topics and approaches, while federal guidance on test, training, and exercise programs emphasizes that exercises familiarize personnel with responsibilities, validate plans and procedures, and strengthen coordination with internal and external stakeholders (Grance et al., 2006; Prümmer et al., 2024). Cyber specific exercise research likewise indicates that realistic scenarios improve incident handling, increase threat awareness, and reveal organizational weaknesses before those weaknesses are exposed in a live event (Alothman et al., 2022). The importance of repetition becomes even clearer under stress. A meta-analysis of pressure training reported a large positive effect on performance under pressure, and stress inoculation research has shown that performance improves when people first understand how stress affects cognition and behavior, then acquire coping and task skills, and finally practice those skills under conditions approximating the operational environment (Low et al., 2021; Robson & Manacapilli, 2014). What practitioners often describe as muscle memory is more accurately understood as the development of automaticity and procedural memory through repeated and disciplined execution. Research on skilled performance under pressure has shown that highly practiced tasks become more automated, whereas pressure can degrade performance when skills are insufficiently consolidated or when individuals are driven back into conscious control of tasks that should already be proceduralized (Beilock & Carr, 2001). In critical cyber moments teams must be able to perform their roles, communicate through the command structure, escalate issues, preserve documentation, hand off responsibilities, and act in concert across functions with a level of fluency that remains dependable even when conditions are adverse. These capabilities are not created during the incident itself. They are built through repeated and disciplined preparation beforehand.

A mature Cyber Incident Response Team, or CIRT, should train regularly and deliberately. In practical terms, one effective model is to host four to six annual training sessions that simulate realistic cyber events. These sessions should be sufficiently grounded in the organization’s actual risk environment to feel credible, and sufficiently structured to reinforce command discipline, transdisciplinary coordination, and recovery thinking. Their value lies not only in exposure to scenarios, but in the repetition they provide. Repeated practice helps convert plans into practiced behaviors, reduces hesitation, improves handoff quality, and strengthens the procedural reliability that becomes indispensable under stress. The scenarios themselves should vary across the year so that the organization exercises different combinations of technical, operational, business, legal, regulatory, and executive demands. One session may focus on a significant data loss event requiring close coordination among cybersecurity, privacy, legal, communications, and business leadership. Another may center on a product compromise or product security event in which engineering, product security, customer support, and executive stakeholders must work through disclosure, containment, and customer impact decisions. A third may simulate a large-scale ransomware attack requiring deep engagement from cybersecurity, information technology infrastructure, business continuity, communications, and executive leadership to address containment, restoration sequencing, and operational prioritization. Another may focus on a database compromise in which database administrators, cybersecurity responders, application owners, privacy stakeholders, and legal teams must coordinate evidentiary preservation, technical analysis, and business risk decisions. Other scenarios may include business email compromise, insider threat, phishing driven account takeover, supply chain compromise, or operational technology disruption. At least one annual session should also be designed specifically for the board and C suite. That exercise can focus on the governance and executive decision questions that arise during a major ransomware event, including whether a ransom demand should be considered, how such a decision intersects with legal and regulatory obligations, how law enforcement engagement should occur, and how business continuity, communications, and recovery priorities should be weighed at the highest level. Corporate calendars, business cycles, and executive schedules often constrain timing, because of this sessions may not replicate real world conditions perfectly in terms of spontaneity. Even with this constraint, they can still reproduce the essential operational demands of actual incidents, including escalation, containment decisions, reporting rhythms, executive engagement, communications coordination, evidence preservation, and restoration sequencing.

The value of these recurring exercises lies not only in repetition, but in normalization. When teams practice together on a regular basis, command structures become more familiar, terminology becomes more precise, and expectations become clearer. Participants begin to understand not only their own roles, but how their roles fit into a larger operational system. This reduces hesitation during actual incidents and strengthens the organization’s ability to act with confidence rather than improvisation. Repetition also reveals points of friction that may otherwise remain invisible until a live event has already created operational pressure. Between the larger annual sessions, readiness should be reinforced through smaller, component-level mini training. These sessions should not function as condensed replications of the larger scenario-based exercises; their purpose is different and more focused. They should concentrate on the specific role skills, workflows, and coordination habits that allow individuals and small teams to function more effectively within the broader CIRT structure. The lead scribe, the command team, the recovery workstream leaders, and other CIRT component leaders can use these sessions to strengthen the practical disciplines that make larger incident response efforts more effective, including status reporting, note taking, escalation timing, documentation quality, handoff precision, command update structure, dependency tracking, and the management of recurring operational rhythms.

An underestimated component of both mini training and broader CIRT readiness training is the disciplined compilation and maintenance of current contact information. Internal leaders, third party responders, outside counsel, crisis communications resources, cyber insurance contacts, federal partners, and other key stakeholders should all be maintained in a form that is accurate, readily accessible, and easy to use under pressure. This information should not be assumed to remain current simply because it was collected during prior exercise or maintained in a static directory. Mini training provides an effective opportunity to verify contact lists, validate escalation paths, confirm after hours reachability, and ensure that participants know exactly where this information resides and how to use it when an incident begins. In practice, outdated or difficult to access contact information can introduce avoidable delays at precisely the moment when speed, coordination, and clarity are most needed.

The objective of these training sessions is not to recreate the full incident. It is to improve the smaller elements of performance that determine whether the larger team operates with fluency, discipline, and cohesion when a serious event occurs. These mini training courses are especially valuable because they allow participants to refine their contribution to the whole while also giving newer volunteers an opportunity to build confidence in role specific responsibilities without the pressure of full-scale exercise. This flexible and adaptable mini training model is especially important in organizations where the CIRT is composed substantially of cross-functional participants who serve in a volunteer capacity in addition to their ordinary professional responsibilities. In such environments, one of the principal watch outs is that the training program must not become so time-consuming that it undermines participation, creates fatigue, or unintentionally discourages capable people from remaining involved. This is not an argument for shallow preparation, it is an argument for disciplined and sustainable preparation. A mature program respects the reality that many of its strongest contributors also have demanding day jobs. The most effective mini training courses are often those that are narrowly scoped, highly purposeful, and designed to improve one or two role-based skills at a time. Short virtual sessions can be especially effective when they are structured with clear objectives, limited participant groups, and practical outcomes. Good practice includes keeping the session length manageable, focusing on a single workflow or decision pattern, using realistic but tightly bounded examples, and ending with a short set of takeaways or improvements that participants can immediately apply. It is also beneficial to provide brief pre reads when needed, avoid unnecessary presentation material, and rely instead on active participation through role walkthroughs, sample handoffs, documentation drills, status update practice, or short command rhythm rehearsals. When designed well, these sessions remain impactful without becoming burdensome, and they help individuals and small teams improve in ways that measurably strengthen the performance of the larger CIRT.

The design of these training courses should begin not with broad incident simulation, but with role clarity and workflow intent. A useful starting point is to identify the specific actions within a role that tend to become difficult under pressure or that frequently affect the effectiveness of adjacent teams. For a scribe, this may include structured note capture, timeline accuracy, the organization of command decisions, and the ability to support the development of a clear, concise, and comprehensive situation report that informs leadership without becoming unnecessarily long or unfocused. For a command lead, it may include concise direction setting, operational prioritization, disciplined status review, and the ability to conduct a clear and defensible transfer of authority to the next commander. That transfer should not be informal or dependent upon memory alone. It should be practiced as a structured handoff in which the outgoing commander reviews status’, unresolved issues, active risks, pending decisions, priority actions, key dependencies, reporting timelines, and any executive or external commitments already made. It is also beneficial for the incoming commander to have the applicable standard operating procedures (SOPs) directly in front of them and to follow the prescribed steps in sequence so that essential actions, documentation requirements, and command expectations are not missed during the transition. When practiced well, this type of handoff improves continuity, reduces the likelihood of omission, and creates a documented transfer process that is disciplined, repeatable, and defensible if later subject to internal review, legal scrutiny, or executive questioning. For a recovery workstream leader, it may include dependency identification, blocker escalation, or the ability to report progress in a way that supports broader command awareness. Once such role specific objectives are defined, mini training sessions can be built around realistic tasks rather than broad scenarios. This keeps the session practical, repeatable, and closely tied to actual CIRT performance. In that sense, the value of these training courses lies in helping each participant and each small team work better as part of the larger system. They improve not only individual competence, but also the collective reliability of the command structure.

Effective design of the training course also requires clarity regarding participation. It should be determined in advance which functions must be present, what roles they will play, what command structure will be used, what assumptions will govern the simulation, what external partners should be included, and what documentation will be produced during the event. At the same time, mature training programs should remain adaptive enough to accommodate the operational realities of busy organizations. Not every team member must attend every training session, and not every training objective requires the same audience or level of live participation. Some modules can be delivered effectively in self-paced form, particularly when the goal is to reinforce role expectations, review updated procedures, validate contact paths, or refresh participants on established workflows. Other sessions may be limited to the specific leaders or functional groups most relevant to the objective being practiced. This kind of flexibility helps preserve participation, reduces unnecessary burden on volunteers with demanding day jobs, and allows the program to remain both disciplined and sustainable over time. When the organization has already established an aligned ICS command model for cyber incidents, the training should reinforce that model rather than inventing an alternate one for the purposes of convenience. The same is true for Zulu time usage, reporting cadence, handoff expectations, and command note discipline. The closer the exercise mirrors the actual command environment, the more operational value it will produce. Exercises should be facilitated in a way that preserves seriousness while still allowing participants to learn. The goal is not theatrical intensity for its own sake. The goal is disciplined rehearsal. Participants should understand the scenario, the expectations, and the operational rules under which the exercise will run. Commanders should command, scribes should document, workstream leaders should report, and executives should engage according to the roles they would hold in an actual incident. Reporting rhythms should be maintained, status updates should be given at defined intervals, injects should be used to test changes in the environment, new facts, dependencies, and emerging business consequences. At the same time, it is entirely appropriate for the facilitator to pause the exercise when a critical concept, role expectation, or workflow is being misunderstood or performed incorrectly. This should not be seen as disrupting the value of the exercise, but as part of its instructional purpose. In many respects, this resembles the work of an effective athletic coach, who stops flawed or confused execution, reinforces the correct technique, walks the team through the proper form, and then resumes practice so that the right habit is strengthened rather than the wrong one repeated. The same principle applies in CIRT training. Allowing errors to continue without correction may reinforce poor practice, whereas pausing briefly to clarify expectations, reviewing the proper procedure, and then continuing can improve both individual learning and collective team performance.

It is not enough for different functions simply to appear in the same exercise. Mature cybersecurity preparation requires those functions to operate through an increasingly shared framework for understanding the incident, prioritizing action, and protecting the enterprise. Technical teams, business leaders, communications professionals, continuity planners, and executive decision makers must learn how to reason together under pressure. That kind of conceptual integration is rarely produced through documentation alone. It emerges through repeated interaction, trusted relationships, and disciplined practice. The purpose of the training is therefore not only to validate procedures, but to build a common operational logic across the teams that will be expected to work together during real disruption. Third party partners, if possible, should also be included in this preparation if they are likely to play a meaningful role during an actual incident. This may include forensic firms, incident response retainers, cyber insurance response resources, outside counsel, crisis communications advisors, federal agencies and critical technology vendors. Organizations should not wait until a live incident is underway to discover how these partners communicate, what information they require, how they relate to the command structure, or where misunderstandings may arise. Their participation in selected exercises can materially reduce friction during actual operations and can accelerate integration when time is at a premium.

No training program is complete unless it is paired with a disciplined lessons learned process. Lessons learned sessions are structured reviews conducted after an incident, exercise, or focused training event to identify what occurred, what worked well, what broke down, what was misunderstood, and what must be improved before the next event. Their purpose is not merely retrospective description. It is organizational improvement. They are not merely informal conversations conducted after an incident or exercise. They are a structured part of the evaluation phase through which the organization analyzes the event, identifies lessons learned, documents observations and recommendations in an after-action report, and uses those findings to improve both the plan itself and the organization’s ability to execute it in practice (Grance et al., 2006). Lessons learned sessions also strengthen team effectiveness when they are conducted as structured after-action reviews rather than as loosely organized discussion. (Steinke et al. 2015) note that after action reviews and debriefings are learning opportunities through which teams examine recent performance events, identify where communication broke down, where coordination did not occur as it should have, and where actions were not properly aligned. The work conducted by Steinke and the team also highlights several practices that make such sessions more effective, including focusing on a limited number of critical performance issues, reducing the delay between the event and the review, providing both individual and team oriented feedback, emphasizing process improvement rather than outcome judgment, creating conditions in which participants feel comfortable speaking candidly, and preserving institutional memory through written notes and captured lessons learned. In the context of cyber incident response, these observations reinforce the importance of structured lessons learned sessions as a means not only of documenting improvement items, but of strengthening communication, coordination, and team learning across the broader incident response structure. They matter because even well-designed training and well executed response activities will expose gaps in assumptions, communication, coordination, documentation, role clarity, timing, and command execution. If those gaps are not captured and translated into corrective action, the organization risks repeating the same weaknesses in future incidents. For this reason, lessons learned should not be treated as informal commentary or as a loosely structured debrief conducted only when time permits. They should be understood as formal discipline within the cybersecurity program. A well-structured lesson learned session should include a clear scope, defined participants, a documented timeline or sequence of events, a review of key decisions and actions, identification of strengths and shortcomings, analysis of root issues, assignment of corrective actions, clear ownership, and a method for tracking those actions through completion. Whether the source is a live incident, a tabletop exercise, a command post exercise, or a smaller role specific training, the organization should have a consistent method for identifying observations, analyzing root issues, assigning corrective actions, tracking ownership, and validating improvement over time. This process becomes even more important when lessons learned are hosted across transdisciplinary teams. The purpose of these sessions is not to revisit events for the sake of fault finding, nor to create a setting in which participants defend decisions rather than analyze them. Such dynamic is dysfunctional and counterproductive. A facilitated lesson learned meeting should create conditions for candid, disciplined, and constructive reflection. Participants should be able to discuss what worked, what did not, what assumptions proved inaccurate, where communication failed, where decision authority was unclear, where dependencies were missed, and what must change before the next event occurs. The focus should remain on strengthening the institution rather than protecting the ego of any one function. In more complex incidents, one lesson learned session may not be sufficient. Large or prolonged events often require an initial session to capture immediate observations and a later session, or series of sessions, to validate facts, align stakeholders, and examine deeper operational, procedural, and governance issues once the organization has regained stability.

The value of lessons learned depends not only on discussion, but on disciplined follow-through. Findings should be documented in a structured manner, categorized by topic and impact, aligned to the appropriate owners, and translated into specific corrective actions with clear accountability and target dates. Those actions may include revisions to playbooks, escalation paths, communications plans, documentation templates, battle rhythms, command procedures, contact rosters, or training content. It is also important that the organization maintain visibility into this improvement work through a formal tracking mechanism so that items are not discussed once and then quietly forgotten. Mature programs review these actions over time, confirm when changes have been completed, and incorporate the resulting updates back into future exercises and mini trainings. In this way, lessons learned become more than reflective exercise. They become a governed improvement process through which experience is converted into stronger readiness.

Over time, this cycle of training, exercise, reflection, correction, and retesting becomes one of the clearest signs of cybersecurity maturity. It demonstrates that the organization does not merely endure disruption but learns from it in a disciplined and institutionalized manner. It also reflects respect for the people who serve within the CIRT structure, because their experience is not treated as expendable effort consumed in the moment and then forgotten. Instead, it is captured, examined, and translated into stronger preparation for the future. In that sense, the training program becomes more than a readiness mechanism. It becomes a living system of organizational learning. The deeper purpose of a cybersecurity exercise, training, and lessons learned program is not limited to procedural readiness alone. It is the cultivation of institutional confidence, operational discipline, and command reliability under pressure. When people have practiced together, documented together, handed off together, learned together, and improved together, the organization develops a markedly different posture toward crisis. It becomes less dependent on improvisation, less vulnerable to confusion, and better able to act with steadiness when time is compressed and uncertainty is high. This does not mean that ambiguity, stress, or disruption disappear. It means that the organization has built the habits, trust, and practiced competence necessary to respond responsibly. A mature cybersecurity program should not be judged solely by the controls it deploys or the attacks it prevents. It should also be judged by the seriousness with which it prepares its people, refines its command structures, strengthens transdisciplinary coordination, and converts experience into lasting improvement. Annual CIRT exercises, role based mini training courses, sustainable volunteer preparation, adaptive training methods, and governed lessons learned processes are not peripheral administrative activities; they are essential capabilities. In an environment where cyber disruption remains a persistent possibility, those organizations that trust each other, train regularly, exercise realistically, learn honestly, and improve systematically are the ones best positioned not only to respond with discipline and recover with confidence, but to lead with credibility, resilience, and institutional steadiness when it matters most.

References

Alothman, B., Alhajraf, A., Alajmi, R. A., Farraj, R. A., Alshareef, N., & Khan, M. (2022). Developing a cyber incident exercises model to educate security teams. Electronics, 11(10), 1575. https://doi.org/10.3390/electronics11101575

Beilock, S. L., & Carr, T. H. (2001). On the fragility of skilled performance: What governs choking under pressure? Journal of Experimental Psychology: General, 130(4), 701–725. https://doi.org/10.1037/0096-3445.130.4.701

Grance, T., Nolan, T., Burke, K., Dudley, R., White, G., & Good, T. (2006). Guide to test, training, and exercise programs for IT plans and capabilities (NIST Special Publication 800-84). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-84

Kesler, E., & Liebrock, L. (2025). A transdisciplinary approach to cybersecurity: A framework for encouraging transdisciplinary thinking. Digital Threats, 6(2), Article 9. https://doi.org/10.1145/3736653

Low, W. R., Sandercock, G. R. H., Freeman, P., Winter, M. E., Butt, J., & Maynard, I. W. (2021). Pressure training for performance domains: A meta-analysis. Sport, Exercise, and Performance Psychology, 10(1), 149–163. https://doi.org/10.1037/spy0000202

Nepal, S., Rajivan, P., Sulaiman, S., Mishra, S., Kumar, N., Liu, Y., Dinh, T., Chi, H., Wang, Y., & Garg, V. (2024). Burnout in cybersecurity incident responders: Exploring the factors that light the fire. Digital Threats. https://doi.org/10.1145/3637304

Prümmer, J., van Steen, T., & van den Berg, B. (2024). A systematic review of current cybersecurity training methods. Computers & Security, 136, 103585. https://doi.org/10.1016/j.cose.2023.103585

Robson, S., & Manacapilli, T. (2014). Enhancing performance under stress: Stress inoculation training for battlefield airmen. RAND Corporation. https://www.rand.org/pubs/research_reports/RR750.html

Steinke, J., Bolunmez, B., Fletcher, L., Wang, V., Tomassetti, A. J., Repchick, K. M., Zaccaro, S. J., Dalal, R. S., & Tetrick, L. E. (2015). Improving cybersecurity incident response team effectiveness using teams-based research. IEEE Security & Privacy, 13(4), 20–29. https://doi.org/10.1109/MSP.2015.71

Disclosure Statement

This article was authored by Kevin Lynn McLaughlin, PhD, with AI used as a drafting and editing support tool. All final content decisions, references, citations, and source selections are made and verified by the author.

Citation

EDPACS _ 2026 _ Kevin Lynn McLaughlin, PhD

From recovery to readiness: Building a cybersecurity exercise, training, and lessons learned program

To cite this article: Kevin Lynn McLaughlin, PhD (2026): From recovery to readiness: Building a cybersecurity exercise, training, and lessons learned program, EDPACS, 1–8, DOI: 10.1080/07366981.2026.2672047

To link to this article: https://doi.org/10.1080/07366981.2026.2672047

Published online: May 11, 2026

Read the full article in EDPACS: https://doi.org/10.1080/07366981.2026.2672047

https://orcid.org/0009-0009-8367-5292