Preparing for cyberattacks with crisis simulations

What it is about

Pavel Solís, from Banco de México, explained at the Third Annual Risk Conference (September 2025) how to prepare for cyberattacks on the financial system through crisis simulations. The opinions are the author's and do not necessarily reflect the official position of Banco de México.

The 22 slides start from the idea that a cyberattack is a latent threat (not a question of whether it will happen, but when and how severe), review current attacks and threats, compare two ways of preparing (controlled real attacks with ethical hackers and crisis simulations) and detail how simulations work, their good practices, Mexico's progressive program and the lessons learned.

Objectives

• Explain why crisis simulations are a tool for preparing for cyberattacks.
• Describe how they are designed and run, and what distinguishes them from a technical or supervisory exercise.
• Share the Mexican experience and its lessons on best practices, collaboration and anticipation.

Key takeaways

1. Simulations are discussion-based exercises built on decision making: a facilitator presents an extreme but plausible scenario and participants decide how to respond.
2. They are not technical exercises, are not passed or failed and are not supervisory: authorities do not collect information from industry participants during the exercise.
3. Their objectives are to test response protocols and communication channels, identify how incidents spread and detect areas for improvement before a real one occurs.
4. Mexico applied a progressive approach: authorities only in June 2023, authorities and banks in July 2024 and, in October 2025, authorities and financial infrastructures.
5. Lessons: implement robust cybersecurity protocols, encourage public-private coordination and define a communication strategy in advance, because time is scarce in a crisis.