Security Theatre For Your Board

Track 101 – 4:15pm

Lisa Belmonte Diaz Strategic Solutions Consultant at th4ts3cur1ty.company

Bio

TBC

Pronouns

She / Her

Talk Abstract

This session aims a practical, "how-to" guide designed to help security leaders build their own high-impact crisis simulations: moving beyond the theory of risk management and into the specific mechanics of operational readiness.

The Core Challenge In cybersecurity, we are obsessed with "The Plan." We invest thousands of hours into compliance frameworks and 100-page Incident Response binders. However, when a live threat hits at 3:00 AM, nobody reaches for a binder.

The cold truth of incident response is simple: You do not rise to the level of your policies; you fall to the level of your rehearsals. If your team hasn’t practiced the technical and psychological movements of a breach, your policy is nothing more than expensive "shelfware." To survive a modern attack, organisations must shift from a Documentation-First mindset to a Performance-First culture. This talk provides the blueprint to bridge that gap.

I will break down the step-by-step process of designing simulations that actually work, including:

The Architecture of a Drill: How to script a simulation that balances technical realism (SOC level) with executive-level decision-making (C-Suite level).

Micro-Drills vs. Full-Scale Wars: Why frequent, 20-minute "injection" drills are often more effective for building muscle memory than bloated annual exercises – talk about how to make your own.

The Psychology of Stress: Understanding "Cognitive Load" and how to train your team to stay functional when the pressure is at its peak.

The "Injection" Library: Practical examples of scenario triggers, from MFA fatigue to supply chain compromises, that you can take home and implement immediately.

Key Takeaways The DIY Simulation Toolkit: A repeatable framework to build, execute, and debrief your own internal crisis exercises without needing an external consultant.

Muscle Memory Metrics: How to measure "Decision Velocity" and "Response Accuracy" to prove ROI to the Board.

Cultural Buy-in: Strategies for convincing busy stakeholders that rehearsal is not a distraction from work, but a core component of it.

Conclusion Stop auditing your paperwork and start auditing your people. Attendees will leave this session not just convinced of the need for rehearsals, but equipped with the exact map needed to build them.

Intended Audience

Head of IT, Business leaders, CISOs, and anyone who wants to know how to run a cyber wargame / table top exercise.

How NSFW is this talk?

(How spicy is your talk in chilli's?)

Mild