How to run a hotwash after a cyber exercise

L8-1What is a hotwash for?

The hotwash captures what players saw and felt before they leave the room and the details fade. It is not the after-action report. The report comes later and is written from the decision log, the evaluator's notes and the hotwash. The hotwash's job is to collect raw observations and first commitments.

L8-2When and how long?

Straight after the last inject, in the same room or call, with the same people. Keep it short enough that nobody leaves early; half an hour is enough for most tabletops. If executives must leave, take their observations first.

L8-3What should the facilitator ask?

1. 01What worked? Start with strengths so the conversation opens up, and so good practice is recorded and kept.
2. 02What did not work? Ask for specifics: which decision was slow, which information was missing, which step of the plan did not match what people did.
3. 03What will we change? For each gap, ask who owns the fix. A gap without an owner goes into the report as open.

Then walk through the objectives one by one and ask the evaluator for a provisional mark: met, partly met or not met. The mark can change when the report is written, but players should hear it.

L8-4How do you keep it honest?

People defend their decisions when they feel judged. Say at the start that the exercise tests the plan and the process, not individuals. The facilitator should not defend the scenario: if players say an inject was unrealistic, write it down and move on. Ask the most senior person to speak last, so others speak freely.

L8-5What must you leave with?

• A list of gaps, each tied to a plan section or playbook step.
• A named owner for each gap, even if the fix is not yet agreed.
• Provisional marks against each objective.
• Completed feedback forms from players and observers. CISA's Tabletop Exercise Packages include a feedback form and an after-action report template.
• The decision log from the note-taker or the platform.

Platforms that record the session change the evidence you leave with. Reflex Security, for example, generates its after-action report when the session ends and traces each finding to the moment it came from; Hack The Box Crisis Control ends with a report, a roadmap and technical annexes. The hotwash is still worth holding: a report tells you what happened, and the hotwash tells you what the players think should change.