Executive tabletop
Board-level: the calls, the trade-offs, the comms, clock running.
Expert services · incident readiness
Respond like you’ve done it before.
Most response plans read fine on paper and come apart the first time they meet real pressure.
Not ready to scope it? Find your fix →Why us
We build the scenario from the inside.
Most drills run a generic ransomware script everyone’s seen. Ours come from the people who run the real attacks, so the scenario moves the way an actual adversary would in your environment, and pushes on the decisions that would actually be hard.
A rehearsal is only worth it if it’s realistic enough to hurt.
The questions you’ll face
Better answered in a room than at 3am.
An incident doesn’t test your tools. It tests whether your people can make these calls, together, fast, with the facts they have. The time to argue runs out quickly.
The clock starts at detection
- 01Triage
Is this an incident, or noise? And who gets to decide, fast?
EscalateStand down - 02Contain
Pull the affected systems offline, and lose the revenue they earn?
Stop the spreadKeep it running - 03Notify72h to report
Who calls legal, the regulator, the insurer, and in what order?
Start the clockMiss the window - 04Pay
Do we pay? Who in this room is even allowed to answer that?
Someone must own itNo one’s authorised - 05Disclose
What do we tell customers, staff and press before someone else does?
Get ahead of itRead it in the news
Every one of these has an owner, a sequence, and a deadline. A drill is where you find out whether you actually know them.
From our research: Hostage negotiation and cyber security →
How it runs
Built from real attacks. Run under real pressure.
Technical drill
Hands-on for the responders, against a real intrusion in your environment.
Combined
Both, sequenced: the boardroom and the SOC rehearse the same incident.
Each scenario is built from how attackers operate now, run live, and closed with an honest debrief — the gaps, and how to shut them.
What you walk away with
A plan you’ve actually used.
Forget the report. What your team keeps is the muscle memory: having made these calls once already, they decide faster and argue less when it’s real.
A realistic scenario
Built from how attackers operate right now.
A live debrief
The exercise run for real, then talked through, honestly.
Tested playbooks
Escalation paths that have actually been run.
A ranked gap list
Exactly what the drill exposed, worst first.
Half a day to multi-day. Executive, technical, or combined.