Using LLMs to Build Cyber Exercises | Ep. 5 The Incident Commander Series
27In this video, Steve Armstrong-Godwin from SANS walks through building cyber exercises using an LLM (large language model) for incident management training. He shares his 30 years of expertise in designing exercises, emphasizing that they don’t have to be difficult or overly complex.
The focus is on creating non-technical, accessible tabletop exercises that are ideal for developing team skills, executive awareness, and testing new capabilities. These exercises are cost-effective, quick to plan, and especially useful for testing processes like third-party data breach scenarios. Steve demonstrates using his custom LLM tool to generate exercise structures, guiding participants through scenarios, and helping facilitators understand what to watch for.
He highlights key steps in the process: setting objectives, defining the core participants, and specifying data types, such as PCI data in supply chains. The tool can generate slides, handouts, and guides for both participants and observers, simplifying setup and offering creative scenario-building options.
Learn about the #LDR553: Cyber Incident Management course Authored by Steve Armstrong-Godwin: https://www.sans.org/u/1vvP
Discover more about SANS Institute's Cybersecurity Leadership: https://www.sans.org/u/1vvU
#CyberIncidentManagement #AI #crisismanagement #Cybersecurity #Leadership #IncidentCommander
Other Videos By SANS Institute
Other Statistics
The Incident Statistics For SANS Institute
There are 1,953 views in 2 videos for The Incident. Less than an hour worth of The Incident videos were uploaded to his channel, making up less than 0.03% of the total overall content on SANS Institute's YouTube channel.