Does your organization involve internal stakeholders (such as senior executives, legal, and HR) in security tests and exercises?

Including key internal stakeholders in security tests and exercises ensures broader organizational awareness and buy-in for security initiatives. When stakeholders participate, they gain firsthand experience with security challenges, understand potential business impacts, and can better align security priorities with business objectives. This involvement also helps break down silos between security teams and other departments, creating a more cohesive security culture. Evidence could include meeting minutes from tabletop exercises showing executive participation, after-action reports from security drills listing stakeholder involvement, or formal security exercise plans that define roles for various internal departments.