The reality is that penetration testing provides no guarantees of security and does not address the weaknesses in an organisation's ability to detect and respond to a sophisticated attack; or its ability to manage a cyber crisis and take the timely decisions to enact cyber defence or system continuity plans. Consequently, there is a need for more sophisticated and technically based crisis exercises to identify causes of failure and to provide training, education and awareness. To most firms, a real-world attack simulation is as much a 'game changer' as actually being targeted. In both ca...