1.2 Exercise Types

Before creating an exercise, consider these key decisions:

Exercise format – What form best fits your learning objectives?
Instructor involvement – Will the exercise be facilitated or self-guided?
Presentation method – How will you deliver the exercise to participants?

Exercise Formats

Keep in mind that these formats are guideline categories. You can create any exercise type that suits your goals, but consider these formats as a starting point.

Micro Exercises (20–40 minutes, 1–4 team members) – Short, focused scenarios for security awareness. Perfect for quick training sessions with pre-built content.

Discussion-Based Exercises (90 minutes, 2–12 team members) – Connected scenarios covering specific topics. Ideal for identifying gaps and improving team communication. Trainees respond to problems through questionnaires, decision tasks, and media inputs. More suitable for general scenarios or managerial positions, but can also be prepared for CSIRT members.

Simulations (90 minutes, 1–4 members) – Your actual processes and policies in simulated incident or other scenario. The most realistic experience for comprehensive team training. This format simulates a real process. The main input is a document describing the response to incidents. Injects are delivered via emails, and the exercise concludes with reflection questionnaires or open questions. Note: Do not choose this format if you plan to create fictional processes—participants will spend more time understanding your imaginary organization than training actual skills.

Note

Lab exercises – IXP can be also used for facilitating hands-on exercises and labs based on virtual machines (VMs) or containers. What is more, IXP can collect and process commands typed by trainees in command line interfaces of these virtual environments. For instance, the tasks in lab exercises can be shown only after a specific command is executed in a VM or container.

With or Without Instructor

Exercises can run with or without an instructor, which affects how you design evaluation and scenario branching.

With Instructor

An instructor evaluates trainee responses in real-time and makes decisions that drive the exercise forward. They review trainee emails and free-form responses, select appropriate email templates to send back based on response content and quality, and trigger different scenario branches through their template selection.

Example: Trainees communicate as a CSIRT team with their manager. If they omit critical incident information, the instructor selects a template requesting clarification. If they include all required details, the instructor sends an approval template that triggers the next phase of the exercise.

This human evaluation allows for qualitative assessment that goes beyond simple yes/no actions—the platform can adapt based on how well trainees perform, not just whether they perform an action.

If your exercise involves instructors or facilitators, you must train them and prepare instructor notes which describes context and list of expected interventions. If you have very comprehensive instructor notes or the exercise is relatively simple and self-explanatory, the formal briefing of instructors can be skipped.

On-Demand (Without Instructor)

Individuals or teams start the exercise whenever they want, without real-time facilitation. This format works best for self-paced training, exercises with clear right/wrong answers, or scenarios where all participants follow the same linear path.

You can still use emails and free-form questions in on-demand exercises, but responses are logged without human evaluation. The platform cannot branch scenarios based on response quality—automatic triggers rely only on whether actions were completed, not how well.

Presentation Method

Different presentation setups influence how you design exercise content. While you can usually adapt exercises between modes, knowing your intended setup helps you optimize content—for example, exercises for large groups with shared screens benefit from more visual elements and shorter texts that work well for discussion or voting.

Teams with Laptop for Each Team or Member

Each team member works on their own laptop. This setup works best for simulation exercises where coordination and collaboration are crucial. Team members can work individually while maintaining seamless communication within the team.

Presentation Mode / Shared Screen

The team gathers around one large screen. This setup is better suited for high-level strategic exercises focused on policy and decision-making, but also works well for awareness topics. The centralized view fosters discussion and collaboration among team members.