Practise the response before the pressure is real.
You may have a capable team and a response plan, but little chance to practise together. We guide you through a realistic security incident, so unclear decisions, handoffs and communication gaps can surface during a rehearsal.
When it helps
When you want to understand how the response would come together, beyond what the plan says.
The plan is written. The team has not tried it together.
People have read the response plan, but have not had to use it through a realistic sequence of events. It is hard to tell which instructions will help and which will leave questions.
- Build a realistic scenario around your existing response arrangements.
- Have participants use the plan as new information emerges.
- Record unclear steps, missing information and useful guidance.
Urgent decisions could land back with you
Your team knows the systems, but may be less clear about who can interrupt a service, involve a specialist or approve an update while the facts are still changing.
- Rehearse decisions with incomplete and changing information.
- Discuss who has authority and when to involve other decision makers.
- Identify missing approvals, fallback routes and decision criteria.
Everyone knows their part. The handoffs are less clear.
Your team and providers may each be capable, but they have not practised coordinating a response. Different assumptions about who acts next could leave work waiting.
- Bring the agreed roles into the same developing scenario.
- Rehearse escalation, handoffs and updates between participants.
- Record dependencies and assumptions about anyone not taking part.
A rehearsal keeps slipping down the list
You know it would help, but preparing a useful scenario, guiding the discussion and capturing the lessons is another job competing with the business.
- Prepare the scenario using existing information and a focused briefing.
- Facilitate the discussion and capture decisions as it develops.
- Turn the debrief into a prioritized list of improvements.
A realistic rehearsal, with practical lessons to take forward.
We prepare and guide a realistic security scenario, then review the lessons with your team and document the priorities. The exercise takes place through discussion, with no live system changes.
Prepare, rehearse and learn together.
- Agreement on exercise objectives, participants, scenario and the response arrangements to explore.
- Preparation using your business context, existing plans and agreed assumptions.
- A facilitated scenario that develops as participants discuss decisions, handoffs and communication.
- A record of decisions, questions and gaps observed during the discussion.
- A debrief and prioritized improvement list, reviewed with the agreed participants.
Clear lessons from the decisions you practised.
- An exercise summary recording the scenario, objectives, participants and response arrangements used.
- A record of key decisions and handoffs discussed, including what helped and where the response became unclear.
- Agreed lessons and a prioritized improvement list, with proposed owners for confirmation.
- Explicit assumptions, unresolved questions and capabilities the exercise did not test.
Beyond the rehearsal and its findings.
Any further work is optional and agreed separately.
- Live attacks, penetration testing, system failover or technical recovery tests.
- Handling an active incident, forensic investigation or emergency response cover.
- Rewriting plans, implementing improvements or running follow-up exercises.
How it works
We prepare the scenario, guide the exercise and document the lessons. Your team brings its working knowledge and practises the decisions together.
Agree the focus
We agree the objectives, participants, scope, price and timing. We review existing plans and gather enough context to make the scenario useful, without asking you to build it.
Prepare the rehearsal
We develop the scenario and brief participants on how the exercise will work. We confirm the starting assumptions, available roles and boundaries, including how absent people or providers will be represented.
Work through the incident
We introduce new information as the scenario develops. Participants discuss what they would do, who they would involve and what they would communicate, while we capture decisions and points of uncertainty.
Turn the lessons into priorities
We debrief with the participants and document what helped, where the response became unclear and which improvements deserve attention first. The written findings separate observed decisions from assumptions and untested capabilities.
Ready to practise the response together?
An informal 30-minute call to discuss what you would like to rehearse and see whether a Tabletop Exercise is the right fit.