Why it's different
An exercise is only useful if something changes afterwards
Scenarios
The incidents most likely to hit you
Ransomware
Encrypted systems, a ransom note and unreachable backups. Do you pay, restore or rebuild?
Business email compromise
A finance director’s mailbox is used to redirect a supplier payment.
Supplier breach
A critical vendor is compromised and you learn about it from the news.
Cloud account takeover
An admin identity is used to exfiltrate data from your cloud tenant.
Insider data theft
A leaver downloads sensitive files in their final week.
Your choice
We build the scenario around the risk that worries your board most.
How it works
From your plan to a stronger one
- 01 Review We read your incident response plan and agree the objectives for the exercise.
- 02 Design A custom scenario with realistic injects, built on your environment and current threats.
- 03 Run A facilitated 2–4 hour session, remote or on site, with an observer capturing decisions.
- 04 Debrief An immediate hot wash, then a lessons-learned session with the report.
- 05 Track Every action is logged with an owner and a date, and followed up.
What you get
Proof you rehearsed, and a plan that improved
Auditors, regulators and insurers increasingly ask for evidence of incident exercises. You get everything they need in one place.
✓
Custom scenario packScenario, injects and participant briefing.
✓
Facilitated sessionLed by consultants who handle real incidents.
✓
After-action reportStrengths, gaps and a prioritised improvement plan.
✓
Updated playbooksRecommended changes to your incident response plan and escalation paths.
✓
Action trackerEach gap owned, dated and followed through to closure.
✓
Evidence packAttendance, report and completed actions for auditors and insurers.
Engagement options
Pick the level your team needs
Leadership
Executive exercise
For boards and leadership teams: decisions, communication and authority.
- ✓Custom executive scenario
- ✓2-hour facilitated session
- ✓Regulatory and comms injects
- ✓Executive after-action report
Most complete
Executive + technical
For organisations that want both levels tested and joined up.
- ✓Two linked tracks
- ✓Technical injects from your environment
- ✓Communication-loss inject
- ✓Action tracker with owners
Programme
Annual exercise programme
For regulated organisations that need regular, evidenced exercises.
- ✓Two to four exercises a year
- ✓Scenario rotation by risk
- ✓Progress tracked across exercises
- ✓Year-on-year improvement report
Questions
Before you ask
Do we need an incident response plan first?+
It helps, but it isn’t essential. If you don’t have one, the exercise shows what the plan needs to cover, and we can help you write it.
Who should attend?+
For executive sessions: leadership, legal, communications and IT leads. For technical sessions: IT, security and key system owners.
Remote or in person?+
Either. Remote works well for distributed teams; in person is best for a first executive exercise.
How often should we run one?+
At least once a year, and after major changes such as a new system, acquisition or leadership change.