The crisis exercise happens with leadership in the room
Simulations attended only by the technical team test half the problem.
In a real incident, the hard decisions aren't technical: do we halt production? notify customers? pay? go public? inform the regulator? None of those are made by a system administrator.
That's why I insist tabletop exercises include leadership, legal, and communications. Two hours, a realistic scenario, no laptops. The output isn't a report, it's a list of decisions nobody knew who owned.