Realistic crisis simulations designed by practitioners who've managed real incidents. Test your plan before you need it.
Most organisations have an incident response plan. Very few have tested it with the people who would actually use it, under realistic conditions, against a scenario that reflects current threat actor behaviour.
Our tabletop exercises are designed by practitioners who manage real incidents. The scenarios aren't theoretical — they're drawn from the types of attack we see in our casework, adapted to your sector, size, and risk profile.
2–3 hours. C-suite and board focus. Decision-making under uncertainty, communications, and regulatory obligations. No technical deep-dives.
Half-day. IT security and IR team focus. Technical containment decisions, forensic priorities, and recovery sequencing.
Full day. All functions engaged: IT, legal, comms, HR, finance, operations. Tests end-to-end coordination across the organisation.
Executive exercises run 2–3 hours. Technical exercises typically half a day. Full cross-functional exercises are a full day. We scope this with you based on your objectives and the time your teams can commit.
Yes — video-facilitated exercises work well, especially for executive and technical formats. Full-scale cross-functional exercises benefit from being in-person but can be delivered remotely where needed.
Yes — and we do this as standard. A healthcare exercise looks very different to a financial services one. We brief against your actual IR plan, your technologies, and sector-specific regulatory requirements.
Share your current IR plan, key contact lists, and any past incident experience. We do the rest. You don't need to prepare your team beyond confirming attendance — the exercise works better when participants haven't seen the scenario in advance.
Annual tabletop exercises are included in Watchful and Vigilant retainer tiers. Guardian includes semi-annual exercises and a more customised scenario.