Gold teaming: crisis simulation based on your own Red Team results
Discover how your Crisis Management Team handles incomplete information, conflicting signals, and a ticking clock—the very situation in which the Red Team has placed your organization.
Our valued clients:
Is Gold Teaming the right step for your organization?
For organizations that have just completed a Red Team test as part of ART/TLPT and wish to elevate the findings to the board level.
This session is suitable if you:
- You have recently completed a Red Team test within the ART/TLPT framework and wish to seriously address the follow-up at the executive level.
- You want to know whether your Crisis Management Team knows how to act when the identified attack path becomes a reality.
- As an institution regulated by the DNB, it must demonstrate that crisis management exists not only on paper, but is also deeply embedded within the organization’s leadership.
This session is less suitable if you:
- If you haven’t conducted a Red Team test yet and would prefer to start with a foundational exercise, then the "Exercise" option is a better fit.
- If you want to test your own crisis plan without linking it to a specific technical process, a simulation is a better fit.
- If you are looking for an ongoing training program rather than a one-off exercise linked to ART/TLPT, then a structured program would be a better fit.
Your Red Team findings will serve as the starting point for the crisis exercise.
The Red Team phase yields valuable technical insights. However, effective crisis management is not a technical issue; it is a managerial one. Gold Teaming reveals how your organization truly responds to a realistic crisis.
Gold Teaming
Executive Management & Crisis Management Team
Red Team & Blue Team
Attack chain, detection, and response
Pentest & scans
Standalone systems and applications
From technical report to managerial readiness
Your Crisis Management Team or executive leadership team works through the scenario demonstrated by the Red Team, experiencing firsthand whether their decision-making, communication, and escalation processes hold up under pressure. This is not a test of knowledge, but an assessment of behavior under realistic conditions.
How a Gold Teaming process works
CCRC provides all three types of exercises prescribed by De Nederlandsche Bank (DNB) within the ART/TLPT framework, ranging from walk-through sessions to simulations. The most suitable option depends on the experience and learning objectives of your Crisis Management Team.
From 2 hours
Walk-through Session (WS)
The Crisis Management Team discusses, step by step, who holds decision-making authority and identifies areas where agreements remain unclear. Suitable for teams with limited crisis experience or following changes to the crisis organization.
From 3 hours
Table-Top Exercise (TTX)
New information arrives at set intervals, requiring the team to make actual decisions under time pressure. Suitable for Crisis Management Teams with some experience.
From 4 hours
Simulation (SIM)
The scenario adapts to the team’s decisions, incorporating opposition in the form of the press, a regulator, or an attacker. Suitable for experienced teams looking to practice under intense pressure—with the option of conducting the exercise unannounced.
Choose the approach that fits where your organization stands
Practice your crisis approach as it should work in reality
A realistic, tailored cyber crisis, practiced with your own plan, processes, and crisis team.
Structural practice, better prepared every year
Recurring simulations that evolve every year with the reality of your organization.
Practice together with your supply chain partners
One crisis scenario, practiced with the crisis teams of two or more organizations in your chain.
Help with your crisis organization, from strategy to playbook
From a departing CISO to a playbook that didn’t work in an exercise: we step in to address the issues that arise before, or alongside, the training.
Why organizations choose to conduct cyber exercises with CCRC
You will train decision-making, roles and communication as it feels in a real cyber crisis.
Experienced
crisis professionals:
You practice with people who know how decision-making and collaboration under pressure really work, not junior trainers.
100% focus on cyber crisis exercises:
No consultancy or security services on the side: just training, simulating and improving your crisis response skills.
From first exercise to established routine:
We guide organizations from their very first experience to structured, annual exercises with visible progress.
Frequently Asked Questions
Gold Teaming is the executive-level follow-up to the Red Team phase within an ART/TLPT (Advanced Red Teaming / Threat-Led Penetration Testing) engagement. The technical findings from that phase are translated into a crisis scenario, requiring your Crisis Management Team or executive leadership to take actual action. While a Red Team engagement concludes once the objectives—or "flags"—have been secured, Gold Teaming begins at precisely that point, examining the broader implications for the organization.
A standard crisis exercise—referred to here simply as "the Exercise"—utilizes a generic scenario that is not specifically tailored to your organization. A simulation or a structured program goes a step further, incorporating realistic scenarios that are customized for your organization. "Gold Teaming" takes this even further: the scenario is based on threat intelligence and empirical evidence, constructed directly from the specific attack path that a Red Team has actually executed within your organization. Consequently, participants cannot dismiss the findings as merely hypothetical, as the vulnerabilities have been demonstrably proven.
Dat hangt af van de ervaring van je team en het doel van de oefening. Voor een organisatie met weinig crisiservaring, of na een recente wijziging in de crisisorganisatie, is de Walk-through Session geschikt. Deze sessie richt zich op het valideren van rollen en procedures. Voor een team dat de aanvalsketen wil doorleven met een uitgewerkte verhaallijn en tussentijdse gebeurtenissen, is de Table-Top Exercise geschikt. Voor een ervaren team dat onder realistische tijdsdruk wil oefenen, inclusief tegenspel vanuit een response cell, is de Simulatie geschikt. In een vrijblijvend kennismakingsgesprek bepalen we samen welke variant het beste aansluit.
The session itself lasts at least 2 hours for a Walk-through Session, at least 3 hours for a Table-Top Exercise, and at least 4 hours for a Simulation. The session is part of a comprehensive process that includes a kick-off, the development of a Gold Team Test Plan, a dry-run to test the injects and the response cell, and a final evaluation.
A Gold Teaming exercise takes place within the confidential and secure learning environment prescribed by the ART/TLPT framework. Throughout the process, CCRC works closely with your Red Team provider, your Business Continuity Management team, IT, and the business, ensuring the scenario remains realistic without compromising confidentiality.
The costs depend on the chosen option, the size of the group, and the complexity of the scenario. CCRC does not have fixed rates for these exercises. Following an introductory meeting, you will receive a proposal tailored to your specific situation.