Training at Altitude: Why Cyber Resilience Requires High-Altitude Stress Testing
Articles by: Richey May, Jun 09, 2025
The Illusion of Readiness
The 2012 London Olympics. Michael Phelps, the most decorated Olympian of all time, was expected to dominate the 400-meter individual medley. He had world-class technique, state-of-the-art equipment, and unmatched experience.
Yet when the moment of truth arrived, Phelps finished a shocking fourth place, off the medal podium entirely.
What happened? Phelps later admitted, “I tried to fake it.” Despite his skill and past success, his diminished conditioning meant he couldn’t maintain peak performance under the extreme demands of Olympic competition.
This same phenomenon (the collapse of performance under real-world pressure despite excellent technical preparation) plays out daily in cybersecurity. Organizations invest millions in sophisticated security tools and meticulously documented incident response plans, yet when actually breached, their response often falls apart. Teams panic, communication breaks down, and critical decisions are delayed or mishandled.
The reason? Security teams often prepare theoretically without subjecting themselves to the stress of realistic incident scenarios. Without this stress conditioning, they “gas out” when confronted with the oxygen-depleted environment of a real attack.
Recent industry reports confirm this disconnect: While the vast majority of organizations1 have cybersecurity incident response plans in place, only 3% are considered “mature”2 in their cybersecurity readiness, including effective reaction to attacks.
The Oxygen Threshold: Why Even Elite Teams Fail Under Pressure
Under oxygen deprivation, decision-making quality drops significantly; risk assessment becomes impaired; and the ability to process complex information diminishes. Panic, the brain’s primitive response to perceived threat, takes control. This explains why Mike Tyson advised that “everyone has a plan until they get punched in the face.”
This cognitive deterioration under stress perfectly mirrors what happens to security teams during cyber incidents. Without stress-condition training, even technically proficient teams experience:
- Cognitive Degradation: Under pressure, untrained teams struggle to recall procedures, misinterpret threat indicators, and make poor, panic-inspired tactical decisions.
- Communication Breakdown: Security teams under pressure experience rapid communication deterioration, with technical language becoming confused, roles blurring, and information-sharing channels collapsing.
- Resource Misallocation: During incidents, untrained security teams often abandon strategic priorities to attend to the “flashing lights” and alarms demanding immediate attention (even if that attention makes the problem worse).
The Altitude Training Principle
Elite endurance athletes train in oxygen-depleted environments precisely because of these cognitive and physiological effects. At higher altitudes, each breath delivers less oxygen, deliberately stressing both body and mind.
This training doesn’t just improve physical endurance; it transforms how the brain functions under stress. Athletes who train at altitude develop neurological adaptations that preserve cognitive function during oxygen deprivation. These adaptations maintain thought clarity, situational awareness, and emotional control in the chaos that causes others to panic.
The cybersecurity parallel is compelling: Tabletop exercises serve as organizational altitude training, deliberately creating stress conditions that transform how security teams perform under pressure. Like altitude chambers for the corporate brain, these simulations build the neural pathways that maintain clear thinking during actual attacks.
Build Your Security Team’s “Cyber Cardio”
Just as altitude training builds an athlete’s ability to maintain cognitive function under oxygen debt, tabletop exercises build your organization’s capacity to think clearly during cyber incidents. This goes beyond having an incident response plan: it’s about creating the neurological pathways that enable clear thinking, effective communication, and strategic decision-making when under extreme pressure.
The most effective tabletop exercises mirror altitude training principles:
1. Simulate Realistic Psychological Stress
Effective tabletop exercises must create genuine stress in a way highly-theoretical, academic discussion cannot. This means inducing time pressure, information overload, conflicting priorities, and unexpected complications; all factors that trigger the brain’s stress response.
Richey May’s tabletop exercises safely create this psychological stress environment through carefully designed scenarios that evolve based on team actions, compressing decision timeframes, and introducing unexpected complications that mirror real-world attack patterns.
2. Build Progressive Neurological Adaptation
The average breakout time (how long attackers need to move laterally across networks) has dropped to just 48 minutes, with the fastest observed at 51 seconds3. Progressive stress conditioning builds the decision-making speed needed in this accelerating threat landscape.
3. Focus on Cognitive Function, Not Just Technical Skills
Effective exercises don’t just test procedural knowledge but deliberately induce the cognitive stress that causes untrained teams to panic. This builds the neural pathways that maintain executive function during crises, preserving the ability to analyze, decide, and communicate when everything is falling apart.
4. Create Consistent Stress Exposure
Organizations must establish a regular cadence of increasingly challenging exercises. Industry research on breach costs confirms this principle: Organizations that conduct regular tabletop exercises show consistently faster recovery times and lower overall impact when facing actual incidents.
The Real ROI of Cybersecurity Stress Testing
When executives evaluate tabletop exercises, they often focus first on compliance requirements or best practices. The real return on investment, however, comes from the fundamental transformation these exercises create in organizational response capability.
Consider these measurable benefits:
1. Reduced Breach Costs
Industry reports consistently show that organizations with tested incident response plans report significantly lower costs when breached. Incident response planning decreased the average cost of a data breach by $248,0724; reflecting how stress-conditioned teams make better decisions under pressure.
2. Decreased Insurance Premiums
Cyber insurance providers recognize the value of stress-tested teams, with many offering premium discounts of 15-30% for organizations that conduct regular tabletop exercises. These savings often exceed the cost of the exercise program, creating immediate ROI.
3. Accelerated Incident Response
Organizations that regularly stress-test security teams identify and respond to threats significantly faster than untested counterparts. Military training experts note that “crew confidence is built by giving them challenging, realistic training”; a principle that applies equally to cybersecurity teams facing complex threats.
4. Enhanced Business Continuity
The most significant benefit is maintaining business functions during attacks. Like altitude-trained athletes who continue performing when others collapse, stress-conditioned security teams preserve critical operations during incidents, which translates directly to protected revenue and reputation.
Beyond the Tabletop
While tabletop exercises form the foundation of security stress testing, truly resilient organizations implement a complete “altitude training” program that conditions response capability at multiple levels, including technical skills development, leadership stress conditioning, and cross-functional testing involving legal, communications, and business units.
The Richey May Approach: High-Altitude Training for Security Teams
At Richey May, our tabletop exercises aren’t academic discussions; they are realistic and stressful simulations designed to build actual and durable resilience. Our approach applies the science of stress adaptation to create exercises that:
- Create Genuine Psychological Pressure: We design scenarios that trigger the same neurological stress responses teams will experience during actual incidents, helping build the mental resilience needed for clear thinking during crises, in a safe environment.
- Build Cross-Functional Stress Adaptation: We bring together key stakeholders from across your organization to develop collective stress resilience that preserves coordination during actual incidents. This includes key functions that are often missed, such as legal and communications teams.
- Provide Structured Performance Analysis: After each exercise, we deliver a comprehensive assessment of how well your system is responding, with specific recommendations for how to improve based on the results. We watch your form during the exercises and make recommendations to enhance your performance under pressure.
- Develop Progressive Stress Conditioning: We design exercise programs that are tailored to each company based on maturity, then help grow the program. We gradually increase the load, building your team’s stress tolerance through incremental adaptation, like athletes progressively training at higher altitudes.
Prepare for the Race, Not Just the Training
Like world-class athletes who focus on race-day performance rather than impressive training metrics, effective security leaders understand that plans and controls only matter if they work under extreme stress. The test isn’t documentation; it’s maintaining clear thinking and operational continuity when sophisticated adversaries attack.
Don’t fall into the same trap as Michael Phelps in 2012 when he discovered too late that past success and technical mastery couldn’t compensate for inadequate conditioning. Build your organization’s stress resilience through regular, realistic tabletop exercises. Ensure that when (not if) attacks occur, your team maintains the cognitive function needed for effective response.
Join Us: Build Your Security Team’s Cyber Resilience
Join cybersecurity experts from Richey May and Arctic Wolf on June 26 to learn more about “Reaching Cyber Resilience: The Importance of Training and Testing.”
Unlock the secret to true cyber resilience … because having a plan isn’t enough if you haven’t put it to the test. Most organizations believe they’re prepared for cyber incidents, but without hands-on training and real-world exercises, critical gaps remain undetected until it’s too late.
During this essential session, you’ll learn:
- How tabletop exercises serve as altitude training for your security team
- Strategies for building cognitive resilience that maintains clear thinking under pressure
- Real-life examples of penetration test findings
- Actionable insights on employee training and incident response from a guest expert at Arctic Wolf
Don’t wait until your organization “gases out” during a real incident to discover gaps in your response capability. Just as elite athletes know that high-altitude training is essential for championship performance, effective security leaders understand that stress conditioning is the foundation of true cyber resilience.
[1] https://www.veeam.com/resources/wp-ransomware-trends-ent-exec.html
[2] https://hostingjournalist.com/news/cisco-study-cybersecurity-readiness-lags-as-ai-threats-surge
[3] https://www.csoonline.com/article/3841865/what-cybersecurity-teams-need-to-know-about-shrinking-attack-timeframes.html
[4] https://www.ibm.com/reports/data-breach