[dkresge]

So, more fundamental than UX, that the proper employee action for an “exercise” differs from that for a real threat doesn’t seem to be a proper test. Why not just have an administrative airgap keyswitch that enables exercises to be conducted without the requirement to disseminate the fact beforehand? Then you can test for the proper response without risk.