Cyber & Incident Response Exercise
Rehearse a live cyber incident end to end — from first alert to boardroom decisions and public communications — before you face one for real.
Explore exercise →The Decision Lab Report
NCALT runs a realistic scenario that unfolds over time, captures how decisions are made and turns the evidence into a report showing what worked, what failed and what must change.
For leadership, resilience and cyber teams who want to understand how their organisation makes decisions as events unfold.
Hydra methodology in use
The Hydra methodology has been used across policing, fire and rescue, national agencies and universities. NCALT now applies that same methodology to organisational decision exercises.








1M+
decision logs recorded through Hydra
30 yrs
of Hydra methodology development
These organisations are identified by the Hydra Foundation as users or partners of Hydra; they are not presented as clients or endorsers of today’s NCALT.
The product
A tabletop can create a useful conversation. A Decision Lab Report creates a record your board, risk committee, auditors and resilience teams can act on.
Anonymous by design
Hydra evaluates the decisions of syndicates—not the performance of named delegates. The focus stays on collective reasoning, organisational learning and psychological safety.
Every report can surface
Final detail to be confirmed
Final detail to be confirmed
Final detail to be confirmed
Final detail to be confirmed
Final detail to be confirmed
See the methodology
Built on the proven Hydra methodology and delivered through Presence, every exercise is designed to make decision-making visible, capturable and useful.
Explore the methodology ↗A realistic, facilitated crisis exposes the decisions your plans cannot predict.
Presence records each syndicate’s decisions and rationale without identifying individual delegates.
Structured review identifies missed signals, delays, strengths and coordination gaps.
The evidence becomes a board-ready Decision Lab Report with recommended actions.
Your leadership team agrees what must change—and what should be rehearsed next.
Syndicate-level
The group’s decisions are the unit of learning.
No individual assessment
Delegates can test judgement without personal scoring.
Facilitator-led
Trained facilitators preserve realism and guide reflection.
Flexible delivery
Presence makes it straightforward to run exercises with more syndicates and participants in different locations.
Exercise catalogue
Rehearse a live cyber incident end to end — from first alert to boardroom decisions and public communications — before you face one for real.
Explore exercise →Rehearse the cross-functional response to a major operational disruption before it happens.
Strategic command decision-making for complex, fast-moving incidents.
Next decision
Request a sample Decision Lab Report and a short demonstration of how NCALT turns an immersive exercise into board-ready evidence.