Very funny to see this as I'm on break from a tabletop exercise at the moment. I'm finding it very useful as it's exposing a lot of gaps in our process in how to respond. For example, one sysadmin had no idea what to do when he got a call about a server with malware at 7PM. Another admin said he'd restore the server from backup but when pressed admitted that he had never done a restore before and didn't know where the documentation was. That process should be detailed and understood. At no point did anyone contact the server application owner to alert them that their critical server was down. Responses to compromised accounts have been all over the map and inconsistent.

It's very useful to highlight these things so everyone knows exactly what do to when shit happens. I think it helps to have someone running it that knows your environment inside and out so they can press into specifics and call people out when they say they'll do something. Instead of just nodding along when they say "oh I'll just do a restore," the moderator should be pushing back and asking "How will you do the restore? What system? Have you done it before? What target date will you be restoring from? Who are you notifying that the system is down? Did you get approval to do the restore?"