Can government and industry prove they’re ready for a cyberattack?

In federal cybersecurity, we need to be able to explain what will happen when a threat reaches the network. A completed assessment can inform that answer, but it cannot establish whether today’s defenses and response procedures will work together. That becomes especially important when the response involves another organization.

Consider what follows an FBI warning to a critical infrastructure operator. Someone must determine whether the activity is present, assess the consequences of containment and decide what evidence to share with federal partners. If isolating an affected system could interrupt an essential service, the security team also needs a mission owner who can authorize the response.

The FBI’s new Cyber Strategy aims to shorten the interval between threat detection and partner notification from days to hours and from hours to minutes. It also emphasizes establishing relationships before an incident, so the bureau knows whom to contact when it has actionable intelligence. Those commitments put an equally important question to the organizations receiving the warning: how quickly can they act on it?

Government agencies and critical infrastructure operators should answer that question through joint exercises with agreed criteria for success. Participants need a common way to document how their defenses performed and whether information reached someone with the authority to act. A partnership’s readiness depends on those handoffs as much as on either organization’s technical capabilities.

Define a successful response before testing begins

Partners can start with one essential service and a scenario based on a threat relevant to their operations. Security teams and mission owners should agree on what they expect to detect, which actions would contain the threat and when they need to involve an outside partner. They should also establish what evidence they can share, through which channels and with whom.

In an exercise involving compromised credentials, for example, an adversary could attempt to reach a system that supports the service. The security team detects the activity, but the analyst does not know who can approve disabling the account. The mission owner needs more information about the effect on operations. Meanwhile, the notification sent to a federal partner lacks the technical evidence needed to act on it. The detection worked, but the response remains incomplete.

The exercise should record how long those decisions took, whether containment stopped the adversary’s progress and how the response affected the service. Participants should also check whether partners received evidence they could use. Each delay or missing piece of information should lead to a specific correction, with someone responsible for making it.

Partners also need to agree on what they mean by a successful test. One team may count an alert as a success, while another may require investigation and containment. Reports should make that distinction clear and identify which systems were tested, when testing occurred and what remained outside the scope. Partners can agree on the detail needed to assess the response while protecting sensitive findings.

Validate that corrective action worked

Joint exercises can expose a failed detection, an open attack path or a response procedure that slows containment. Agencies need a process for prioritizing those findings, assigning corrective work and checking the results as systems change. Continuous Threat Exposure Management (CTEM) is a commonly used framework that provides that discipline, using mission priorities and relevant threats to guide what teams address and validate.

Within that process, Adversarial Exposure Validation (AEV) lets teams test whether defenses can interrupt the attacker behavior used in the scenario. If an exercise reveals that compromised credentials allow an adversary to reach a critical system, teams can test whether changes to access or defensive controls block that route. Testing should account for the risk of disrupting the service.

After addressing a weakness, teams should repeat the relevant test to determine whether the change worked. Closing a remediation ticket establishes that an action was completed; it does not establish that the defense improved. Findings involving response procedures need follow-up as well. If an exercise exposed an unclear approval process, the next exercise should confirm that responders can reach someone authorized to act.

The gaps that remain contribute to threat debt, the accumulated opportunity an adversary can still exploit. Leaders need to understand which attack paths remain open, how those paths could affect the mission, and which exposures they have chosen to accept. Tracking those findings over time helps them determine whether corrective work is reducing attacker opportunity and where further action is needed.

Those results need to stay current. A new cloud service, a permissions change or an adjusted detection can affect a previously successful defense. Agencies and operators should establish recurring validation and decide which changes require additional testing. Joint exercises should also check that partner contacts and response procedures still work.

Train teams to act on the evidence

Training belongs in this process. Operators need to understand what a validation result establishes, what it leaves unanswered and how to explain the implications to a mission owner. Partners should practice those judgments against the same scenario so they can identify differences in how teams interpret the evidence.

Tabletop exercises can clarify responsibilities before hands-on exercises test the agreed response. Participants should work through the sequence, from receiving a warning to investigation, containment decisions and evidence sharing. Mission owners should take part wherever a response could affect service delivery.

The purpose is to find delays while there is time to fix them. If a responder cannot reach an authorized decision-maker, that is a readiness finding. If information arrives through an approved channel but lacks the context a partner needs, that is another. Each should produce a specific correction and a later exercise that checks whether it worked.

Within a large agency, common reporting criteria can reveal problems that recur across components. Leaders can compare results while preserving differences in missions and environments. With limited staff and resources, they need to distinguish a finding that threatens an essential service from one with less operational consequence. A shared approval bottleneck may warrant an enterprise change; a detection gap may require work by a local team. Reporting should make those decisions easier.

The FBI’s strategy gives government and industry a reason to examine both sides of the notification process. Faster warning creates more time to defend a service, provided the receiving organization can use it. Agencies and operators can begin now by choosing a shared scenario, agreeing on the expected response and testing the decisions that connect them. The resulting evidence should show where action stalled and whether subsequent changes removed the delay. That is what partners need to know before relying on each other during a real attack.

Kathy Hsu is vice president of federal at AttackIQ.