Minutes to Meltdown: What a Crisis Simulation Revealed About Cyber Resilience.

It's easy to feel prepared for a cyber incident when everything is running smoothly. But what happens when systems go down, pressure mounts and difficult decisions need to be made quickly?

That's exactly what we explored at our recent Minutes to Meltdown event, hosted alongside our partners at Commvault and Softcat.

It's easy to feel prepared for a cyber incident when everything is running smoothly. But what happens when systems go down, pressure mounts and difficult decisions need to be made quickly?

That's exactly what we explored at our recent Minutes to Meltdown event, hosted alongside our partners at Commvault and Softcat.

Instead of an afternoon of presentations, attendees were thrown into the middle of a simulated airline crisis, where critical systems were disrupted and every decision had consequences.

The challenge wasn't about who knew the most about cybersecurity. It was about how people respond when the unexpected happens. Who takes responsibility? What gets prioritised? How do you keep the business moving when the situation keeps changing?

It made for some interesting conversations and highlighted what cyber resilience looks like in practice.

1. Cyber Resilience Is About More Than Technology

When we talk about cyber resilience, it's easy to focus on the technology. Firewalls, backups, recovery platforms and security tools all have an important role to play.

But what happens when those systems need to be put to the test?

One of the biggest takeaways from the simulation was just how much depends on the people and processes behind the technology.

If nobody knows who's making the final decision, teams aren't communicating or recovery priorities haven't been agreed, even the most sophisticated technology can only do so much.

Being cyber resilient isn't just about having the right tools. It's about knowing how to use them, who needs to act and what matters most when things go wrong.

And that makes resilience a business-wide responsibility, not just something for the IT department to worry about.

2. The Biggest Risks Are Often the Gaps You Don't See

Most organisations have plans in place for when things go wrong. But there's a difference between having a plan and knowing how it'll hold up under pressure.

Throughout the simulation, attendees had to think beyond the immediate technical problem.

What happens if a critical system can't be restored as quickly as expected? What if one team's decision has an unexpected impact elsewhere? And how do you keep everyone informed when you don't yet have all the answers?

These are the kinds of questions that can be difficult to answer in the middle of a real incident.

The value of an exercise like Minutes to Meltdown is that it creates space to explore those challenges without the consequences of a real-world crisis.

It also highlights why assumptions are worth challenging. Just because a process looks good on paper doesn't necessarily mean it'll work exactly as expected when the pressure is on.

3. Do You Really Know How Resilient Your Organisation Is?

It's a question that sounds straightforward, but the answer isn't always easy.

You might have invested in cybersecurity, strengthened your backup capabilities and documented your recovery procedures. But how do you know whether those measures add up to genuine resilience?

That's where understanding your current position becomes so important.

Frameworks such as NIST and DORA can help organisations think more systematically about resilience, from risk management and governance through to incident response and recovery.

They're useful for identifying where processes are working well, where there may be gaps and what needs attention next.

Because improving resilience shouldn't be about investing in technology for the sake of it. It should be about understanding the risks that matter most to your business and making informed decisions about how to address them.

4. Cyber Resilience Needs Continuous Improvement

If there's one thing the simulation reinforced, it's that being prepared today doesn't automatically mean you'll be prepared tomorrow.

Businesses change. Technology evolves. New threats emerge. And the systems, processes and people an organisation depends on rarely stay the same for long.

A recovery plan that worked perfectly a year ago might not reflect how your organisation operates today.

That's why resilience needs regular attention.

Whether it's reviewing recovery priorities, testing backup and restoration processes or running exercises that bring different teams together, the aim is to keep learning and improving.

The goal isn't to predict every possible crisis. It's to build the confidence and capability to respond when something unexpected happens.

About Minutes to Meltdown

Minutes to Meltdown is an immersive cyber resilience simulation designed for technology, security and business leaders.

Participants are placed in a realistic incident scenario and challenged to make decisions around business continuity, communications, recovery and operational resilience as events unfold.

The exercise helps organisations better understand their preparedness, identify potential gaps and gain practical insight into responding to a cyber crisis.

How Confident Are You in Your Cyber Resilience?

From understanding your current resilience maturity to strengthening backup, recovery and business continuity capabilities, Iomart helps organisations prepare for disruption and recover with confidence.

If you'd like to explore how resilient your organisation really is, get in touch with our team.