Insights from Simulation Exercises on Strengthening Cyber Risk Governance

Cybersecurity is no longer just an IT responsibility; it has become a strategic business challenge that requires active involvement from boards and executive leadership. As cyber threats become increasingly sophisticated, organisations must be able to make informed decisions under uncertainty while balancing cyber resilience, business performance and continuity.

This research draws on more than 1,800 simulation exercises involving 240 board members, executives and business leaders, as well as interviews with senior executives. Through a strategic digital twin approach, participants were able to experience realistic cyber risk scenarios in a controlled environment, testing strategic decisions around security investments, financial performance and organisational resilience without exposing their organisations to real-world risks.

The findings identify four key principles for stronger cyber risk governance: continuous adaptation, iterative learning, business-wide responsibility and proactive capability development. They demonstrate how simulation-based learning can help leaders improve decision-making and prepare their organisations for an increasingly complex cyber threat landscape.  

Want to learn more?

Read the full report to explore the findings and discover how strategic simulations can help strengthen cyber risk governance and organisational resilience. Available here!

References
Zeijlemaker, Sander; Proudfoot, Jeffrey G.; Pal, Ranjan; and Siegel, Michael (2026) "Insights from Simulation Exercises on Strengthening Cyber Risk Governance," MIS Quarterly Executive: Vol. 25: Iss. 3, Article 7.