The Adversarial Resilience Drill Playbook 2.3D.3-2

Adversarial resilience drills test systems before the real failure arrives. They are to organizational resilience what stress tests are to bridges: you learn what fails before failure happens in consequence.

This playbook provides a framework for designing, executing, and learning from drills.

Drill Design: Principles

Realism Over Comfort

A drill should look like a real failure. This makes it uncomfortable. That discomfort is the point.

A comfortable drill frames the scenario as hypothesis: "If the data center goes offline, we switch to backup." A realistic drill makes the scenario live: "The data center goes offline at 3 AM Thursday. Backup is offline too (a wire was misconfigured). Customer service starts lighting up. Customers cannot access accounts. Media is asking questions. Teams are tired."

Realism surfaces problems. Comfort confirms existing assumptions.

Surprise and Adaptation

Some aspects of the drill should be unknown in advance. Teams cannot memorize the right answer; they have to think. A well-designed drill frame is: "We are simulating a cyber breach. You know it happens during the scenario, but you do not know when or what system is affected. Your incident response team must discover it, assess it, and respond."

Surprise forces actual incident response, not recitation of script.

Multi-party Participation

Drills that involve only internal teams find only internal problems. Real failures involve partners, regulators, customers. Include customers (how do they learn of the problem? can they still use critical services?), partners and vendors (does the organization's failure cascade to them? can they support recovery?), regulators (are notifications required? can they be done accurately and on time?), and media (how does communication work? is it credible?).

Multi-party drills surface ecosystem-level problems that single-organization drills miss.

Documented Scoring

Do not conduct a drill and then disappear into meetings. Document what happened and score outcomes.

For each scenario, score these categories: detection (did the organization notice the failure? how long did detection take?), assessment (did the organization understand what failed and what impact it had?), communication (did the organization communicate clearly to stakeholders, leadership, and relevant public?), recovery (did the organization restore service? in what timeframe? was recovery complete or degraded?), and learning (did the organization identify what caused the failure? did it identify how to prevent recurrence?).

For each category, score as: Achieved, Partially Achieved, or Not Achieved. Document evidence.

Minimal Actual Impact

Drills should cause problems without causing catastrophic loss. A financial services firm drills backup recovery by actually restoring from backup to a test environment, running through the recovery process, and restoring critical systems to backup systems (not production systems). Live customers are never affected, but the organization learns what would happen. A health organization drills pandemic response by simulating a surge in cases without actually exposing staff to infectious material. Protocols, equipment, staffing, and communication are tested without real risk.

Drill Scenarios: Library and Framework

Scenario 1: Cyber Security Incident (Quarterly)

Scenario trigger: Malware detected in customer-facing system. Data has been exfiltrated. Organization must assess extent, notify customers, and recover.

Drill variables (mix and match to vary difficulty): When is breach detected (1 hour after infection? 24 hours later?)? What systems are affected (payment system? customer records? both?)? What has been exfiltrated (names and emails? passwords? financial data?)? Are backups clean (malware spread to backups or isolated to live system?)? Media coverage (is breach in news? are customers calling?)?

Scorecard:

Multi-party elements: A breach notification law firm reviews communication for legal compliance. Key customers are briefed on extent of breach and security response. Media relations team prepares public statement.

Publication: All results are published in post-drill report, including any failures and remediation plan.

Scenario 2: Critical Infrastructure Failure (Semi-Annually)

Scenario trigger: Primary data center becomes unavailable (fire, electrical failure, physical security breach). Backup systems must be activated.

Drill variables: Single system down (e.g., payment processing)? Entire data center down (all systems)? Backup systems also unavailable (forces graceful degradation vs. failover)? Duration (4 hours? 24 hours?)? Is customer traffic affected (can you reroute? how long?)?

Scorecard:

Multi-party elements: Customers are notified of degraded service. Partners who depend on the system are informed of limited availability. Regulators may need to be notified if service levels are materially affected.

Publication: Post-drill report including recovery time, data loss (if any), and customer impact.

Scenario 3: Supply Chain / Financial Crisis (Annually)

Scenario trigger: Critical vendor fails (goes bankrupt, breaches contract, is acquired and changes terms). Organization must find alternative supplier or absorb cost impact.

Drill variables: What vendor (choose a critical one)? Why do they fail (bankruptcy, acquisition, breach)? What is your fallback (pre-negotiated backup vendor? can you self-supply?)? Cost impact (what is price increase? can you absorb it?)? Timeline (how fast do you need alternatives?)?

Scorecard:

Multi-party elements: Customers are informed of potential supply impact. Vendors in your supply chain are asked how your failure would affect them (stress test for cascade failure).

Publication: Post-drill report including supplier resilience assessment and diversification improvements.

Scenario 4: Governance Crisis (Annually)

Scenario trigger: Executive misconduct is discovered (fraud, harassment, violation of governance charter). Organization must investigate, manage stakeholder response, and potentially remove executive.

Drill variables: What misconduct (financial fraud, personnel violation, misuse of emergency authority)? How is it discovered (whistleblower, audit, regulator)? Is it public (media know? customers know?)? What is your response (immediate termination? investigation first?)?

Scorecard:

Multi-party elements: Board is involved in decision-making (not delegated to executive). Legal counsel provides guidance. HR and compliance are involved. May involve external investigator.

Publication: Report is published (with privacy protections for accusers). Governance improvements are visible.

Scenario 5: Multi-Party Crisis (Annual)

Scenario trigger: Major crisis involving multiple jurisdictions and stakeholders. Example: Product defect causes customer injury; defect is discovered by media; customers sue; regulators investigate; competitors offer safety-focused alternative.

Drill variables: Crisis is real (customer injury, product failure, data breach). All stakeholders are involved (customers, media, regulators, competitors, partners). Multiple timezones or countries (adds communication complexity). Conflicting interests (customers want compensation; regulators want accountability; shareholders want stock price protection).

Scorecard:

Multi-party elements: This is a full-scale exercise with external participation. Customers, regulators, media, and potentially competitors are involved. Exercises real-world complexity.

Publication: Full post-mortem is published (may be delayed if litigation is involved, but eventually published).

Drill Execution Checklist

Pre-Drill (1 Week Before)

Document the scenario and communicate it to the core incident response team (small group; not all staff). Brief external participants (customers, vendors, regulators, media contacts) that this is a drill. Set up the drill environment: test systems that can be stressed without affecting production. Identify the incident commander and confirm readiness. Draft the communications plan (who gets notified, in what order, with what message). Assign a scribe to document what happens (for post-drill review). Finalize success criteria and draft the scorecard.

During Drill

Initiate the scenario at the pre-planned time. Notify the incident commander and activate response. Document the timeline: when things happened, who was notified, what actions were taken. Introduce surprises (if pre-planned) to force adaptation. Update multi-party observers on progress at scheduled intervals. Continue until success criteria are met or drill duration ends.

Immediate Post-Drill (Day 1)

Debrief the incident response team while memory is fresh. Ask: what worked? What failed? What surprised you? Create early draft of timeline from scribe notes. Fill in preliminary scorecard.

Post-Drill Analysis (Within 1 Week)

Draft the full report including scenario and objectives, what actually happened (timeline), scorecard results (achieved/partial/not achieved for each capability), what worked well (and why), what failed (and why), and recommendations for improvement. Review with incident commander and senior leadership. Collect external participant feedback (if applicable). Prioritize recommendations: quick fixes vs. structural changes vs. training needs.

Publication and Follow-Up (Within 2 Weeks)

Publish the full post-drill report (internally and/or publicly, as appropriate). Create remediation plan: who is responsible for each recommendation, deadline, metrics for success. Track remediation progress (next drill should show improvement in previously-failed areas). Brief the board on results and remediation plan.

Using Drill Results to Improve

Drill failures are not failures — they are early warnings. A system that finds problems in drills avoids finding them in real crises.

Example 1: Backup System Failed in Drill

Drill discovered: During infrastructure failure scenario, backup systems did not automatically activate. Manual intervention was required; 45 minutes were lost.

Remediation: Investigate why automatic failover failed (was it configured? tested? alert properly triggered?). Fix the technical issue. Test backup system monthly (previously tested only annually). Include backup-system testing in every infrastructure drill.

Next drill should show: Automatic failover in less than 5 minutes.

Example 2: Communication to Customers Was Delayed

Drill discovered: In cyber breach scenario, customers were not notified within 24 hours. Legal review of the notification took 48 hours.

Remediation: Pre-draft notification templates for common breach scenarios. Pre-authorize legal counsel to approve standard templates without delay. Establish escalation path: if legal cannot review within 4 hours, proceed with notification and legal follows up.

Next drill should show: Customer notification within 24 hours of discovery.

Example 3: Governance Drill Revealed No Process

Drill discovered: No clear process for investigating misconduct allegations. When fictional executive was accused of fraud, the board did not know what to do.

Remediation: Develop detailed misconduct investigation process: who investigates, what standards apply, how confidentiality is maintained, how findings are documented. Designate external investigator in advance (pre-agreement, not ad hoc). Board training on investigation process.

Next drill should show: Clear investigation process, investigation initiated within 24 hours, external investigator engaged.

Frequency and Cadence

Different drill types have different frequencies. Cyber and security drills run quarterly (attacks are evolving rapidly; drills should be frequent and varied). Infrastructure and business continuity drills run semi-annually (systems are relatively stable; semi-annual testing is sufficient for most systems). Financial and supply chain drills run annually (drills are costly to set up; annual is reasonable). Governance drills run annually (misconduct is rare; annual testing is appropriate). Multi-party drills run annually (full-scale drills are resource-intensive; annual is typical).

Within the annual cycle, stagger drills so that the organization is not constantly in drill mode. Example schedule:

The Practice

An enterprise practicing Resilient Objectivism (RO) at this level operationalizes the principle that you learn what breaks before it breaks at scale. It does this by conducting regular adversarial resilience drills (quarterly cyber, semi-annual infrastructure, annual financial and governance); designing for realism and surprise (so drills simulate real failures with enough surprise that teams must adapt, not recite); including multi-party participation (so customers, vendors, regulators participate to surface ecosystem problems); documenting and scoring rigorously (so every drill produces a report with clear assessment of what worked and what failed); publishing results (so all drill reports are made available internally at minimum, externally where appropriate); and tracking remediation (so failed drills trigger improvement plans, and next drills check whether improvements were made).

This connects directly to epistemic integrity's correction-channel discipline (1.2.1) — the fold target for resilience's retraction as a standalone pattern — which establishes that a design must not destroy the channel through which later evidence could correct a conclusion: failure detection and graceful degradation designed into systems from the start, not backup planning that happens if you have time. The drill playbook operationalizes that discipline: it moves from principle to practice by making failure detection regular, documented, and actionable.

The connection to the organizational incident response runbook (2.3C.4) is close: that runbook establishes how the organization responds when a real incident occurs. The drill playbook tests whether the runbook actually works. Similarly, the organizational hazard scan (2.3C.4) identifies what failure modes are live possibilities; the drill playbook tests the organization's readiness against those specific hazards.

The playbook also connects to the arc 2 error-friendly retro (2.2.3), which establishes that disagreement and error detection are treated as data, not as failure or disloyalty. The drills themselves are designed failures, and the retro methodology ensures that the learning from drills is captured systematically rather than dismissed or hidden.

The practice is not perfect resilience. It is resilience designed so that every failure is a learning opportunity, not a disaster.