Incident response tabletop exercises
Run the exercise. Keep the evidence.
Writing the incident response plan is the easy half. PCI DSS requires it tested every twelve months; HIPAA, CMMC, EU DORA and NIS 2 require it tested too; and SOC 2, ISO 27001 and your cyber insurer ask when you last did and who was in the room. TTX Commander runs the exercise with an AI game master and writes the after-action report at the same time — every control claim linked to the moment in the timeline that substantiates it.
- ScenariosRansomware, cloud account compromise, insider threat, supply-chain breach
- Coverage matrixNine frameworks, grouped and counted per framework in the report — though not all nine in every scenario. Which one produces what
- Report formatsJSON for the record, Word for the working copy, PDF for the filed copy
The problem
An afternoon, five figures, and a slide deck
Most companies run the exercise once a year, badly. A consultancy delivers it as a facilitated engagement — scenario design, a half-day in a room, a written after-action report. Everyone reads from a script. Nothing surprising happens, because nothing was allowed to.
Then the auditor asks which controls the exercise actually tested, and the honest answer is that nobody was writing that down. The report says the team performed well. It does not say that at T+37 the IT lead isolated the affected host, which is the sentence the auditor was looking for.
The exercise is not the deliverable. The evidence is. That is the part the room is worst at producing, because producing it well means someone taking minutes instead of participating.
$10,000–$25,000What a facilitated tabletop engagement costs today — scenario design, the half-day, and the written report. That band is the price umbrella this product sits under, and it is the only market figure stated anywhere on this site.
Who is asking
Five require the test. Four require nothing and ask anyway.
The obligation is not one framework's. PCI DSS puts a twelve-month clock on testing the plan; NIST SP 800-171 § 3.6.3 is a single sentence telling you to test the capability; DORA Article 11(6) says at least yearly; HIPAA and NIS 2 carry a testing duty with a scope test in front of it. SOC 2, ISO 27001, NIST CSF 2.0 and ISO/IEC 27035 require no test at all — the auditor simply asks for the evidence. And not one of the nine requires a tabletop: every one of them leaves the method to you.
- 01SOC 2No criterion requires a test
- 02PCI DSSTested at least every 12 months
- 03CMMC and NIST SP 800-171Test the capability — no frequency stated
- 04ISO/IEC 27001No stated exercise frequency
- 05HIPAA Security RuleRequired, but addressable — and about the contingency plan
- 06EU DORATest the response and recovery plans yearly
- 07NIS 2Required for the digital-provider types
- 08NIST CSF 2.0Voluntary. It mandates nothing
- 09ISO/IEC 27035Guidance in “should”. Nobody is audited to it
Every one of those statements is a clause you can look up, and the frameworks page prints it — including the two places the market routinely gets it wrong, which are HIPAA (the testing specification is Addressable and reaches the contingency plan) and NIS 2 (the explicit testing duty binds one list of digital-provider entity types, and everyone else answers to their own Member State).
One exercise does not cover all nine. Each scenario pack maps only the frameworks it can honestly evidence, so the framework you need decides the scenario you run: PCI DSS and DORA come from the supply-chain breach, NIS 2 from the cloud account compromise, HIPAA from the ransomware. SOC 2, ISO 27001, CSF 2.0 and ISO/IEC 27035 are in all four. The full table is on the frameworks page.
How it works
Four steps, ninety minutes, one filed report
A facilitator opens a session and sends links. The room works an incident that is not happening. The report assembles itself out of what actually occurred.
- 01
Open a session, pick a scenario
Four scenario packs ship today — ransomware, cloud account compromise, insider threat and supply-chain breach. Each carries its own control map, chosen for that scenario rather than copied from the last one.
- 02
Send four links
CISO, IT lead, legal, comms. A signed link each, scoped to one session and one role, short-lived. No account, no password, no email collected. They join from their phones.
- 03
The game master runs the room
It delivers the complications, plays the ransomware crew and the CFO who wants finance back now, and adapts to what the room decides. A beat clock advances simulated time on its own, so the complication scheduled for T+40 arrives at T+40 even in a quiet room.
- 04
The report is already written
A dated roster of who played which role, a timeline, the decision record with the game master's assessment of each call, the gaps, and a coverage matrix grouped by framework — each group carrying its count, its testing obligation, the clause behind it, and every control tied to the minute of the exercise that demonstrated it. JSON, Word and PDF.
What makes it different
The hard part is not the roleplay. It is staying coherent for three hours.
The state lives outside the model
A model improvising from a growing transcript starts contradicting itself around the ninety-minute mark: it revives a server the team already isolated, or re-announces a complication it delivered an hour ago. So the transcript is not the source of truth. The clock, the pressure level, each actor's stance, the canonical facts, the open threads and the control coverage are held outside the model, and the game master reads a compact snapshot of them each turn and can change them only through validated tool calls. The improvisation is genuine; the state is not negotiable.
Every control claim carries its evidence
Every event in the exercise gets an id. A control-coverage claim that cites nothing, or cites something that never happened, is rejected before it reaches the report. The metrics, the coverage matrix, the gaps, the timeline and the decision record are assembled deterministically from the immutable event log — no model gets a vote in them.
Co-pilot for consultants, self-serve for companies
In co-pilot mode the game master proposes each material move and waits for the facilitator to approve, edit or reject it: the human keeps the room, the machine keeps the state. In self-serve mode a company runs the whole thing with nobody hired. Same engine — the difference is one conditional edge in the graph.
Participants never create accounts
The room joins by a signed link, not a sign-up. A guest reads the participant view and submits actions, and that is the whole of its authority: every facilitator route answers 403, and a link minted for another session gets the same 404 a stranger gets. There are no seats to buy because there are no seats.
What-if branching
The most valuable question in the debrief is the one the room could not afford to ask live: what if we had paid? Fork the exercise at any completed turn and run the counterfactual as an independent session. The real exercise is untouched and its report is unchanged — and a fork does not consume an exercise from your plan.
It narrates effects, never technique
The game master describes what the room observes and what the stakeholders do. It does not produce attack instructions, tooling, commands or credential handling. That rule is enforced three ways: in the prompt, in a schema validator that refuses to load a scenario pack breaking it, and by a content classifier on the model's own output — when the classifier declines a move, the turn falls back to the authored one rather than shipping it.
Who it is for
Two buyers, one engine
Anyone with a recurring test to evidence
A PCI DSS twelve-month window, a CMMC assessment date, a DORA annual test, a HIPAA contingency-plan analysis, a surveillance audit, a SOC 2 Type II period, a customer questionnaire, an insurance renewal. Different clause, same request: show me the test, who took part, and what changed afterwards.
Fractional CISOs and security consultants
You run tabletops for a living. Co-pilot mode is built for you: keep the client relationship and the judgment calls, hand off the state-keeping and the report writing, and run more engagements in the same week.
Security leaders who already run exercises
You do not need convincing that the exercise is worth running. What you need is for the evidence to survive the walk from the room to the auditor's request list.
The door that is not a framework
Your renewal application asks when you last tested the plan
If the cyber insurance form in front of you asks whether the incident response plan has been tested in the last twelve months, and who took part, that question carries no control identifier and belongs to no standard on this site. It wants a date, a scenario and a roster of names. An exercise here produces all three on the way to producing everything else.
This is the widest door in the building, because it is the only one that opens for a company with no compliance programme at all — the machine shop, the clinic, the fifteen-person software company whose first SOC 2 is two years away. The deadline is not yours to move, which is the useful part.
Say this part out loud
The after-action report records what did not work. The escalation nobody could name, the contact list a year out of date, the decision that took forty minutes too long — a report that records none of that is a photograph of a whiteboard with extra steps.
It is also a business record, and a business record is discoverable. Answering the underwriter's question is one thing; handing them the findings is another, and it is a decision for you and your broker rather than for us.
What it is not
The boundaries, stated up front
Not a breach-and-attack simulation tool
Nothing is deployed on your network. No agents, no traffic, no scanning, no connection to your systems at all. This is a discussion-based exercise — the format PCI DSS names in its guidance on Requirement 12.10.2, and one of the methods NIST SP 800-171 lists for testing a response capability.
Not a phishing simulator
Different problem, different product.
It does not certify anything
It produces evidence you can present. Whether that evidence helps you with a given auditor, assessor, supervisor or underwriter is their call, and any vendor telling you otherwise is selling you something they cannot deliver.
Not a replacement for your incident response plan
It is the thing that finds out whether the plan survives contact.
Where it is today
Built, tested, and not finished
The engine is built and proven where it matters. A compressed three-hour exercise runs end to end under test with the coherence invariants asserted every turn: the clock never runs backward, no complication is delivered twice, every control claim resolves to a real event, the running summary never loses a fact, and every narrative thread the game master opens gets closed.
Four scenario packs ship today, each driven through a full offline exercise in the test suite. Reports render to JSON, Word and PDF. Subscriptions, exercise quotas and the customer portal are implemented.
Not built yet
- Self-serve signup. Facilitator accounts and organisations are provisioned by hand today; get in touch and we will set yours up.
- The scenario authoring interface. Scenario packs are authored content in the repository, not something you can write in the product.
- White-label report branding, multi-client separation, the scenario library and API access are defined in the plan table but have no enforcement point in the product yet.
Your next exercise
Someone will ask. Have the answer written down.
If you run tabletop exercises for clients, or your own test is coming due and you would rather it produced something an assessor can read, start with the clause that applies to you — then the price list, then write to us and we will get you a session.