When cyber plans fail: A pre‑mortem approach

According to ASIC’s 2023 study, "33% of survey] participants do not have a cyber incident response plan". ([Source)

For the organisations with a cyber incident response plan, how confident can they be whether it would actually work when there is an incident? This session challenges the traditional approach to cyber resilience training by flipping the script. Instead of rehearsing success, participants are taken through a pre-mortem exercise, a structured, facilitated method that imagines that a cyber incident has already occurred and asks one critical question:"If this failed, why did it fail?"

By working backwards from failure, organisations uncover the real gaps in decision making, capability, crisis communication, and governance risks. Cyber resilience is no longer just a technical issue, it is a leadership, governance, and whole of organization capability challenge.

Boards and executives are being held increasingly accountable for cyber incidents, yet many still rely on static plans, compliance driven frameworks, and assumptions that don’t hold under pressure. Traditional training often builds confidence in documentation, not confidence in execution. A pre-mortem approach creates psychological safety to surface uncomfortable truths, enables more honest conversations bringing together technical and non technical aspects of the incident response, and delivers far more actionable insights than conventional simulations.