Built from your real infrastructure
Scenarios name your actual hosts, clusters and buckets rather than a generic template. If an end-of-life host is the most plausible foothold in your estate, that is the one the scenario uses.
See it in the demoYour incident response plan has never been tested against your own infrastructureFind out how it holds up
Generates a tabletop exercise from your live asset inventory, naming your real hosts, databases and backups, runs it across every role on the team, and scores each answer against what a good response actually looks like.
Try it
Interactive demo with a completed exercise, no signup, no cloud account
How It Works
Read the estate, build the scenario, run it, score it.
01
Read
Pulls your current asset inventory and profiles the environment, what runs where, what is exposed, what is encrypted, what is past end of life.
02
Build
Selects the scenario type that fits your infrastructure and writes it around your actual resources. Every scenario names at least three real assets, and injects escalate on a timeline.
03
Run
Delivers role-specific questions to each participant, then releases timed injects that change the situation and force the team to re-prioritise mid-exercise.
04
Score
Evaluates every answer across five weighted dimensions, with written feedback, named gaps and prioritised training recommendations per role.
What You Can Do
Everything the exercise does.
Eight roles, each tested properly
CISO, SRE, DBA, network engineer, security analyst, DevOps, compliance officer and application owner each get questions matched to their remit, competencies and the services they actually operate.
See it in the demoEscalating injects on a clock
Three to five timed injects move from initial detection through scope expansion, exfiltration and a recovery decision, so the team is tested on re-prioritising, not just on a first answer.
See it in the demoSeven scenario types
Ransomware, data breach, infrastructure failure, DDoS, insider threat, supply chain compromise and region-loss disaster, selected to match your environment's profile.
See it in the demoScored across five dimensions
Technical accuracy, completeness, prioritisation, communication and compliance awareness, weighted 30/25/20/15/10, with per-dimension strengths and gaps written out for every answer.
See it in the demoCross-role collaboration tested
A role interaction matrix checks the handoffs that break in real incidents, analyst to CISO escalation, SRE to DBA failover coordination, compliance officer to CISO on regulatory timelines.
See it in the demoGap analysis, not just a score
Identifies the patterns across the whole team, names which roles are affected, and turns them into prioritised recommendations you can act on before the next drill.
See it in the demoAudit evidence for exercise requirements
Maps to PCI-DSS 12.4.1, NIST SP 800-61, ISO 22301 and SOC 2 CC7.2–CC7.4, and shows which controls a given scenario did and did not exercise.
See it in the demoTrack readiness over time
Exercise history lets you show that scores moved after training, rather than asserting that preparedness improved.
See it in the demoBusiness Outcomes
What it changes.
Real
Drills reference the systems your team actually operates, so the answers reveal genuine readiness rather than familiarity with a template.
Specific
You learn which role is weak on which dimension, not just that the exercise went adequately.
Evidenced
The annual exercise requirement is satisfied with a scored, dated artifact instead of a meeting invite and a slide deck.
Run your first exercise against your own estate.
Connect a read-only role and the first scenario is generated from your live inventory in minutes.