Service · Crisis rehearsal
Cybersecurity tabletop exercises
A structured, facilitated walkthrough of a cyber crisis — no live systems, no real damage, just your team making the decisions they'd have to make for real.
Book an exerciseWhat it is
A rehearsal for the worst day, where mistakes are free
We gather the people who'd actually respond to an incident — executives, IT, security, legal, communications — and walk them through a scenario that unfolds in real time. As it escalates, we introduce new information ("injects") and ask the room: what do you do now, who decides, and who do you tell?
How a session runs
One scenario, four phases
Every exercise follows the same arc as a real incident — from the first alert to the debrief.
T-00:00
The scenario begins
An alert lands — ransomware, a data leak, a supply-chain compromise — chosen to match your real threat profile.
T+00:20
The situation escalates
New facts arrive on a timeline: a journalist calls, a regulator's clock starts, systems keep going dark.
T+00:55
Your team responds
The room makes the calls and we capture every decision, assumption and gap as it happens.
T+01:30
Findings & action plan
We reconstruct the timeline together and leave you with a prioritised, owner-assigned action list.
T-00:00
TriggerThe scenario begins
An alert lands — ransomware, a data leak, a supply-chain compromise — chosen to match your real threat profile.
T+00:20
InjectsThe situation escalates
New facts arrive on a timeline: a journalist calls, a regulator's clock starts, systems keep going dark.
T+00:55
DecisionsYour team responds
The room makes the calls and we capture every decision, assumption and gap as it happens.
T+01:30
DebriefFindings & action plan
We reconstruct the timeline together and leave you with a prioritised, owner-assigned action list.
Who it's for
Built for the people who'd be in the room for real
Executive & board
Practise the strategic calls: when to notify, when to pay or not, when to go public.
IT & security
Pressure-test detection, containment and escalation against a scenario that fights back.
Comms & legal
Rehearse regulatory notification, customer messaging and press response on the clock.
Whole-of-org
Align every function on a single, shared response — before you need it.
What you walk away with
Not a certificate. A to-do list.
A prioritised action plan
Concrete gaps, each with an owner and a deadline — the day's most valuable artifact.
A tested response plan
Your incident-response plan, proven against a real scenario and updated where it broke.
A more aligned team
Executives and responders who now share the same mental model of a crisis.
Evidence of readiness
Documentation for your board, auditors, insurer and regulators (DORA, NCCS, NIS2).
Regulated?
Mandated to test your resilience? We help you meet it — and prove it.
If you fall under DORA or the EU Network Code on Cybersecurity, rehearsing your response isn't optional. Every exercise we run leaves you with the documentation to evidence it to auditors and regulators.
Financial entities
The Digital Operational Resilience Act requires a digital operational resilience testing programme — and names scenario-based testing among the required tests. Our tabletop exercises deliver exactly that.
Reg. (EU) 2022/2554 · Ch. IV
Electricity & energy sector
The EU Network Code on Cybersecurity requires high- and critical-impact electricity entities to manage cyber risk and rehearse crisis response. We design exercises that fit your NCCS obligations.
Reg. (EU) 2024/1366
Not sure whether you're in scope? We'll help you find out.
Let's design your scenario.
We'll shape the exercise around your sector, your systems and the incidents that keep you up at night.
Book an exercise