Every organisation faces cybersecurity threats, and among the most dangerous are Advanced Persistent Threats (APTs). These sophisticated, stealthy, and prolonged attacks are often orchestrated by nation-state actors or highly skilled cybercriminal groups. APTs aim to infiltrate networks, establish long-term access, and extract sensitive data without immediate detection.
The sophistication of such actors and the negative impact they can have on the Australian economy can trigger the government to issue advisories. An example is the Australian Signals Directorate APT40 advisory issued on 9 July 2024. It warned that APT40, a People’s Republic of China state-sponsored group, has repeatedly targeted Australian networks and can use proof-of-concept exploits for new high-profile vulnerabilities within hours or days of their public release.
To counter these threats, businesses implement various security policies and procedures—but how can they ensure their effectiveness? Are employees following protocols as intended? Are response teams prepared to act decisively in the event of a breach? Without testing, hidden vulnerabilities may remain unnoticed until exploited by malicious actors.
Live fire exercises provide one of the most effective ways to assess an organisation’s ability to detect, respond to, and mitigate APTs. These simulations immerse cybersecurity teams in real-time attack scenarios, replicating the tactics, techniques, and procedures (TTPs) used by advanced threat actors. By exposing security gaps, strengthening defences, and refining incident response strategies, live fire exercises empower organisations to stay ahead of persistent adversaries and foster a culture of cybersecurity resilience.
Live fire exercises create highly realistic environments where organisations can experience sophisticated cyber threats firsthand. APTs typically employ multi-stage attacks, including phishing, zero-day exploits, and lateral movement within networks. Simulating these tactics allows teams to evaluate their readiness in identifying and neutralising such threats before they cause significant damage.
APTs are notorious for exploiting unknown and newly disclosed vulnerabilities. Live fire exercises subject systems, networks, and personnel to simulated attacks, revealing weaknesses that standard security audits might overlook. Organisations can use these insights to bolster security controls, patch vulnerabilities, and refine their defensive strategies to counter APT methodologies.
Responding to APTs requires swift, coordinated action. Live fire exercises enable cybersecurity teams to practise containment, eradication, and recovery procedures in a controlled setting. These exercises help refine communication, decision-making, and threat-hunting skills, helping ensure teams can respond effectively under real-world pressure.
APT defence is a team effort. Live fire exercises provide an opportunity for cybersecurity professionals to collaborate with industry experts, red teams, and incident responders. Sharing insights, best practices, and threat intelligence enhances the organisation’s ability to recognise and counter emerging APT threats proactively.
One of the most valuable aspects of live fire exercises is instant feedback. As cybersecurity professionals engage in simulated APT attacks, they receive real-time assessments of their performance. This feedback allows teams to recognise strengths, address weaknesses, and refine their defensive techniques continuously. Rapid learning and adaptation are critical in combating ever-evolving APT tactics.
Live fire exercises are a vital component of an organisation’s cybersecurity strategy, particularly in defending against APTs. By subjecting security teams to realistic, high-pressure scenarios, these exercises enhance their ability to detect, respond to, and mitigate sophisticated threats. Running through these simulations provides confidence that systems have been rigorously tested, helping organisations stay one step ahead of advanced adversaries.
Organisations that prioritise live fire exercises not only build stronger cybersecurity defences but also cultivate a proactive security culture—one that is essential in today’s evolving threat landscape.
StickmanCyber's Cyber Threat Intelligence team can help you plan and execute live fire drills for your organisation.
Book a free consultation with one of our experts to get started.
A live fire exercise is a hands-on simulation in which defenders detect and respond to realistic attack activity in real time, in a live or closely replicated environment. Rather than talking through a plan, it tests whether people, processes and tools actually work under pressure. NIST describes this kind of operational test as a functional exercise, which lets staff validate their plans and readiness in a simulated operating environment.
A tabletop exercise is discussion-based: NIST SP 800-84 describes participants meeting to talk through their roles in a scenario presented by a facilitator. A live fire exercise is hands-on, so teams use their real tools and procedures to detect and contain simulated attacks. Tabletop exercises suit testing decisions and communication, while live fire exercises test technical execution.
Not quite. A penetration test aims to find and exploit vulnerabilities in specific systems. A red team, as defined by the US Committee on National Security Systems, emulates a potential adversary’s attack capabilities to show the impact of a successful attack and what works for defenders. A live fire exercise often uses a red team to play the attacker, but its focus is on how well the defending team detects and responds.
ASD’s ACSC recommends implementing the Essential Eight. Its APT40 advisory also calls for comprehensive, centralised logging, patching internet-facing infrastructure within 48 hours, segmenting networks to limit lateral movement, enforcing least privilege, using multi-factor authentication on remote access services and replacing end-of-life equipment. A live fire exercise then tests whether those controls and your monitoring actually detect APT-style activity.
Some do. APRA’s CPS 234 requires regulated entities such as banks, insurers and superannuation trustees to review and test their information security response plans annually. Under the Security of Critical Infrastructure Act 2018, the Department of Home Affairs can require responsible entities for Systems of National Significance to run cyber security exercises and report on them. For other organisations, regular exercises are a practical way to test incident response plans.
There is no single rule. CPS 234 says the frequency and nature of security testing should match factors such as how quickly threats and vulnerabilities change, how critical and sensitive the information assets are, the consequences of an incident and how often those assets change. For most organisations, a sensible baseline is at least one exercise a year, plus another after significant changes to systems or the threat landscape.