Facilitator guidance¶
The facilitator’s job is not to run the exercise. It is to create the conditions under which the exercise can be honest.
That distinction matters because most things that go wrong in incident simulations go wrong before anyone enters the room: unclear objectives, participants who do not know what is expected of them, no shared understanding of what happens when something feels wrong, a debrief structure that produces polished summaries rather than real observations. The preparation is where the facilitator’s influence is largest.
Before the exercise¶
Prepare the environment in the Montessori sense: everything the exercise needs is in place before it begins. Logistics, communication tools, scenario materials, actor briefings, technical injects, stop words, role confirmations. A simulation that loses its first hour to setup problems does not recover that hour.
Brief each group separately with what they need to know. The testing team needs objectives, rules of engagement, and the inject schedule. The defending team needs to know an exercise is happening, what the safety boundaries are, and that their performance is not under performance evaluation. That last point matters more than it sounds: if participants believe they are being assessed, they will perform competence rather than demonstrate it.
Establish the stop word before starting. Not as a formality. A live exercise with actors and real communication channels can produce situations that require immediate de-escalation. Having the stop word known in advance makes that possible without confusion or loss of face.
During the exercise¶
The facilitator’s primary mode is observation. Watch what the team engages with and what they avoid, where communication flows and where it stalls, which decisions come quickly and which produce hesitation. Satir’s survival stances are visible in exercises: the technical lead retreating into detail to avoid naming the decision that set the conditions, the incident commander placating the stakeholder inject rather than managing them, the team that computes rather than acts when the scenario exceeds the playbook. These are not failures. They are findings. Record them.
Injects are not tests of resilience. They are calibrated to surface specific assumptions. An inject that reveals the communication gap between technical and communications functions has done its job whether or not the team handles it well. An inject that simply overwhelms the team produces stress but not learning. The facilitator adjusts the pacing when the exercise is producing paralysis rather than pressure.
Intervene when something genuinely requires it: a safety concern, a technical failure in the exercise infrastructure, a participant who is visibly distressed beyond productive discomfort. Do not intervene to help the team avoid a difficult decision. The difficult decisions are where the exercise is most valuable. A facilitator who steps in to resolve a deadlock teaches the team that someone will resolve it for them.
The debrief¶
The debrief is where the learning happens. The exercise is the stimulus; what the team does with it in the debrief is the output. A well-run exercise followed by a poor debrief produces a vivid experience with no retained understanding. A thorough debrief of a flawed exercise can produce more learning than a perfect one with no reflection.
Facilitation over instruction applies directly: the facilitator’s job is to ask questions that surface participants’ models and examine them against what the exercise revealed, not to explain what the right answer was. Begin with the immediate hot wash while the experience is still fresh. Then move to the structured retrospective with the questions that reach the structural level: not what happened, but what had to be true about the organisation for it to happen that way.
The conditions in the debrief reflect the conditions in the organisation. A debrief that produces safe summaries, where everyone agrees things could be improved without naming what specifically was wrong and why, is showing you something about the organisation’s communication culture. The facilitator’s job is to make the debrief safe enough for honest accounts without letting it become comfortable enough for dishonest ones.
Action items that come out of the debrief need owners, timelines, and a distinction between procedural fixes and structural ones. A runbook update is a procedural fix. A change to decision authority, escalation paths, or cross-team coordination is structural. If the action list is entirely procedural, the exercise found symptoms rather than conditions.