We can’t afford to learn the hard lessons of a crisis in the middle of a response. We need to bring those lessons forward and learn them before the crisis hits.

That was my starting point at UNSW Canberra’s Emerging Voices Series, where I joined Australia’s National Security Coordinator, Lieutenant General Michelle McGuinness, for a fireside conversation on national cyber resilience, moderated by Professor Craig Stockings, Head of the School of Humanities and Social Sciences. A theme ran through the whole discussion: incidents are a question of when, not if. That makes how we prepare our leaders one of the most important questions we face.

01The threats have changed. Our training hasn’t kept up.

Throughout the day we heard about the unprecedented nature of the threats facing our nation and our organisations: the changing character of war, the changing decision-making environment, and the new expectations we place on leaders to adapt.

War games, crisis simulations and tabletop exercises are how we prepare for that. They put leadership under pressure, test decision-making, and expose weaknesses before a real crisis does. But at Capital Shield we’ve been challenging ourselves to think about how we might start training more like we’ll have to fight today, and to look beyond the traditional discussion-based tabletop exercise.

Incidents are a question of when, not if. That makes how we prepare our leaders one of the most important questions we face.

For us, modernising it comes down to three problems:

  • Realism. Exercises need to reflect the environment we’re actually operating in.
  • Accessibility. Organisations that don’t traditionally rehearse their crisis response should be able to do it regularly.
  • Measurability. Organisations need to test their assumptions and understand where they really sit on resilience.

02A Friday afternoon call

Here’s what that looks like in practice. With bird flu in the headlines, there was real anxiety across agriculture and the poultry industry. A major poultry producer approached us. Resilience wasn’t something they’d traditionally thought about much, but suddenly it was very real.

We worked with their team to design their worst-case scenario, and brought in their senior leadership team, from the CEO through to the people running their farms. Then we put them in it. On a Friday afternoon, a regulator calls: bird flu has been identified at one of your farms, and you’ll have to cull two flocks of 60,000 birds within 48 hours. That’s your revenue for the rest of the year. Protesters line up out the front. Suppliers have problems. Customers start pulling out.

What made it different is that every stakeholder was played by an AI agent: the regulator, journalists, members of the public, employees, union reps, lawyers, suppliers and customers. The leadership team was on the phone to them, emailing them and texting them, having real dialogue under real pressure.

That made the experience dynamic, and it gave us data on how the team actually performed. At the end, they received a report showing where their assumptions failed, where they didn’t follow their business continuity plan, and where their crisis communications broke down. They left with a set of remediation actions and were far better prepared.

Every stakeholder was played by an AI agent. The leadership team was on the phone to them, emailing them and texting them, having real dialogue under real pressure.

03Verification paralysis

My team and I recently returned from Germany, where we ran a series of scenarios on Russian hybrid attacks on critical infrastructure with the NATO Defense College, among others. The scenarios vary, but there are common threads. Clients expect scenarios to reflect the operating environment we’re in now, which means misinformation, disinformation and deepfake content.

One pattern has stood out, which I’ve called verification paralysis. Leaders are confronted with a piece of information and try to work out whether it’s credible intelligence, or whether it’s manipulated, unreliable or designed to trip them up. In that moment they either decide or they delay. And the delay can be just as costly as getting the decision wrong.

If we expect our leaders to perform under pressure in these environments, we have to make sure they’ve actually practised in them.

The delay can be just as costly as getting the decision wrong.

04“We haven’t got time to practise”

One of the most common barriers we encounter is time. Across every sector we work in, senior leaders tell us the same thing: “We’re too busy running the business. We’re too busy dealing with the crisis. We haven’t got time to practise.”

The work Lieutenant General McGuinness and her team are doing to encourage leaders to sit down and think through how they’d respond to a major crisis matters. If we can build more of that culture and resilience mindset across the private sector and government, we’ll be much better prepared as a country.

05A national exercise for Australia

Asked what one thing would make Australia meaningfully better prepared, I pointed to two ideas. The first is Sweden’s concept of total defence, where organisations outside defence have a responsibility to stand up in a time of crisis or emergency. The second is the large national crisis simulation exercise Singapore runs every year. It has a critical infrastructure and cyber focus, but it involves all three levels of government, communities, schools and local councils.

Something like that for Australia could help us be far better prepared.

One of the clearest messages of the day was the need to challenge old ways of thinking as we face new threats. Adapting the way we train is, I think, one of the most important things we could do today.

This article is adapted from Tim Hobbs’ remarks at the Emerging Voices Series: Strategy, Security & Defence at UNSW Canberra.