Carolyn Geason-Beissel/MIT SMR | Getty Images
In July 2024, the cybersecurity software company CrowdStrike pushed a routine but buggy software update to its platform. In the ensuing 78 minutes, before a patch was deployed, IT systems worldwide crashed. Microsoft estimated that 8.5 million Windows devices were affected. As blue screens of death cascaded across the globe, airlines grounded fleets, hospitals lost access to patient records, and banking platforms went dark. One analysis estimated that the collapse cost Fortune 500 companies $5.4 billion.
Six months earlier, a ransomware group had accessed Change Healthcare, the largest medical claims clearinghouse in the United States, through a single portal that lacked multifactor authentication. Within days, nearly every pharmacy, hospital, and physician practice in the U.S. was unable to process insurance claims. Surgeries were postponed, and the personal health data of as many as 1 in 3 Americans was exposed. Combined direct response costs and business disruption impacts incurred by parent company UnitedHealth Group exceeded $2 billion in the first half of 2024 alone, according to the company’s filings with the Securities and Exchange Commission.
Two incidents. Two different failure modes. Combined documented losses exceeding $7 billion. In both cases, crisis experts wondered, had anyone rehearsed this?
They could have. As far back as 2022, McKinsey was reporting that 70% of C-suite technology executives at large enterprises were exploring and investing in digital twins as a way to optimize operations, model supply chains, and accelerate decision-making. A digital twin is a dynamic virtual replica of an organization’s operations, supply chain, manufacturing lines, IT infrastructure, or distribution network, connected in real time to the data flows that govern its physical counterpart. Unlike a static model, a digital twin updates continuously as conditions change, and it can be queried, stressed, or reconfigured without touching the physical system.
Few companies are using this modeling capacity to rehearse crisis scenarios. They’re not using it to test what happens when a software provider’s routine update crashes their operating environment, or when their largest payment processor goes dark. But they could be. The gap between what digital twins are used for and what they could be used for is not a technology gap. It is a strategic gap that has cost organizations billions of dollars and is risking the loss of much more.
Warning Signals From Practitioners
To test whether this gap was visible at the practitioner level, I conducted a structured poll during a session titled “Rehearsal Intelligence: AI Digital Twins for Crisis-Ready Organizations” at ASIS Europe 2026, a Tier 1 international conference drawing risk professionals from across sectors and geographies. Roughly 40 practitioners attended the session; between 19 and 23 responded to each poll question. While I cannot claim that this convenience sample is statistically representative, its composition — exclusively senior security and resilience practitioners with direct organizational visibility — offers a meaningful practitioner-level signal.
Of the 21 respondents who identified their role, 47% were corporate security directors or heads of security. The remainder were in risk management, security consulting, and C-suite functions.
Asked how often their organization conducts crisis simulations, 68% reported once a year, through a tabletop exercise — typically, a facilitated discussion in which a team walks through hypothetical scenarios and planned responses. A further 15% reported never testing the crisis plan at all. Only 5% reported conducting simulations continuously, using live data or digital tools.
The second question produced the starkest finding. Of 22 respondents, 20 (91%) reported that their organization was not using digital twins in any capacity. Two said that their organization used digital twins for operational monitoring. Not a single participant reported using digital twins for crisis simulation.
The third question identified future impediments. Asked what the primary obstacle was to adopting digital twins for crisis management — and, by extension, where challenges might lie in organizations yet to adopt general digital twin technology — 43% said “insufficient leadership awareness and buy-in.” This was the top answer, above budget constraints, technical complexity, and data integration challenges.
Why Traditional Simulations Are No Longer Enough
An executive might reasonably say, “We have crisis teams, we run tabletop exercises, and we have AI. Is the absence of digital-twin-based rehearsals truly a strategic risk?”
To be clear, tabletop exercises run by crisis teams have genuine value. They align work groups, expose assumptions, and create shared mental models. No serious resilience professional would argue against them. But they carry structural limitations that become more consequential as crisis complexity increases.
First, tabletop exercises operate on pre-constructed scenarios. In other words, the exercise is designed around a crisis someone has imagined. CrowdStrike and Change Healthcare were not included in anyone’s tabletop scenarios. The crisis that will actually test your organization is, by definition, the one that was never in the playbook. Second, tabletop exercises are episodic. The muscle memory that organizations build inevitably decays between quarterly or annual sessions. And third, tabletop exercises test the team, not the system. The exercise reveals how particular crisis management team members think under pressure, but it does not reveal how the actual organizational systems, supply chain, IT infrastructure, customer-facing operations, or financial flows might behave under real crisis conditions. Stress-testing examines financial or technical resilience within defined parameters but is not designed for cross-system cascade failure. The gap between what a team decides and what the organization can execute is precisely where most crisis responses break down.
Artificial intelligence adds some value to planning, but less than leaders might expect. In a peer-reviewed study published in March 2026 in International Studies of Management & Organization, researchers Raphaël De Vittoris and Carole Bousquet analyzed 24 cri
