Microsimulations and sixty-minute sessions: how short can a useful exercise be?

The classic tabletop exercise takes a morning, a meeting room and weeks of preparation. Many organisations run one a year. Crisis exercise platforms have been shrinking that format, and the shortest versions now take minutes. This note looks at what short formats do well and what they lose.

How short have exercises become?

On the pages we read:

• iluminr describes microsimulations of 3–5 minutes for one person and 30–45 minutes for a team, alongside facilitated tabletops.
• Reflex Security describes sixty-minute sessions in your real environment, with the scenario built in minutes and the after-action report produced at the end: in its words, from threat to after-action in a single afternoon.
• TryHackMe lists a 10 min average time on its tabletop exercise page, without explaining what the time covers.

Traditional tabletops remain available too, including CISA's free packages, which assume you facilitate the session yourself.

What do short formats do well?

Frequency. A five-minute decision exercise can run every week; a half-day tabletop cannot. Frequent practice keeps roles and authority fresh, especially in teams with turnover, and it gives more data points. iluminr's August 2026 update leans into this, describing continuous capability testing through microsimulations and behavioural evidence such as decision velocity, confidence and alignment.

Reach. Short individual formats can include people who would never get a seat at the main tabletop. iluminr describes benchmarking by department, region and role.

Availability. Formats that do not need everyone in the room at once are easier to schedule. Reflex describes asynchronous play and AI agents in seats nobody fills, including the CEO's.

What do short formats lose?

Stamina and arc. Real incidents last days. A long exercise tests whether people stay coherent as information piles up, whether shifts hand over cleanly, and whether early decisions come back to bite. A five-minute scenario cannot test that.

Group dynamics. Some of the most useful findings in a tabletop come from disagreement between executives, or from someone realising mid-exercise that they do not have the authority they assumed. Individual microsimulations do not surface those.

Depth of follow-up. A short exercise can produce a short report. The value of any exercise is the fixes it produces, and that work takes the same time whatever the exercise length.

How should a programme mix them?

A reasonable pattern for decision-makers:

1. Short, frequent exercises for individuals or small groups, to keep roles and authority fresh and to collect data over time.
2. A few team sessions a year, around an hour, that rehearse a realistic scenario end to end with the core response group.
3. At least one longer exercise a year that tests the full arc of an incident, including executive and board decisions and external communication.

The evidence from all three should feed one record of gaps, fixes and retests.

What do the vendors say about recognition?

iluminr states that its microsimulations appear in the Gartner Hype Cycle for Risk, Compliance and Audit Technologies, 2026, for a third consecutive year, and that it was named a Chartis RiskTech100 2027 Disruptor. Those are the vendor's statements about analyst recognition; they say the format is getting attention, not that it fits your team.

What should a security leader do next?

Count how many times your decision-makers practised an incident in the last twelve months. If the answer is once or never, frequency is the gap, and a short format is the quickest fix. If they practise often but only in short bursts, schedule the long exercise.

The side-by-side page for iluminr and Reflex Security sets their published facts next to each other, and the crisis simulation guide lists every platform here that sells the format, including those with longer sessions.