Pricing
An exercise is the unit of value, the unit of cost, and the thing you are actually buying — so it is the only thing TTX Commander meters. Not per framework: one exercise produces one record, and the report maps that record against every framework its scenario covers at no extra charge. Not per seat either, because participants never create accounts. Annual and prepaid on the direct ladder, with overage credits when a year turns out busier than planned.
What you are comparing against
Read that comparison carefully. The consulting figure buys a senior practitioner in the room making judgment calls, and this product does not replace that person — co-pilot mode exists precisely because it should not. What it replaces is the scenario design, the state-keeping and the report assembly, which is where the hours go and where the evidence gets lost.
Annual, prepaid. Sized to how many separate exercises your regimes and scoped entities actually require — one plan tested once a year is a different number from four subsidiaries on four calendars, or from a PCI obligation and a DORA one that no single scenario evidences at once.
Free
One complete exercise, so you can see the report before you buy it.
$4,800per year
One certification, one or two exercises a year, one report to file.
$12,000per year
Several scoped entities, several certifications, or a quarterly cadence.
Co-pilot mode, priced per exercise rather than per engagement, so the margin on your delivery is yours.
$9,600per year
A fractional CISO or independent consultant with a standing client book.
$28,800per year
A security practice running tabletops as a repeatable line of business.
Two disclosures about the tier lists above. White-label report branding, multi-client separation, the scenario library and API access are defined in the plan table and are what these tiers are intended to unlock, but they have no enforcement point in the product yet — there is no branding hook in the report renderers today, and no public API surface beyond the routes the console itself uses. They are listed so the tiers describe what is being sold rather than only what already runs. Second: every price on this page is a list price we have set, not one validated by a market of closed deals.
Overage credits. One extra exercise at the tier's marginal rate — $2,000 on the direct ladder, $900 on the partner ladder — bought from the customer portal. Exceeding your included exercises does not degrade anything you have already run.
Questions
Because the obligations that drive this are annual — PCI DSS 12.10.2 says at least once every 12 months, DORA Article 11(6) says at least yearly, and a SOC 2 Type II window is a year long — and monthly billing on an annual-use product is an arbitrage: subscribe in March, run the exercise, cancel in April, and buy a $2,400 deliverable for $400. The direct tiers are annual and prepaid for that reason. The partner tiers may bill monthly, because a consultant's usage really is continuous and the same trick does not work.
Starting a new exercise returns a 402 naming your tier, the limit, your usage count and the end of the period, with a link to the customer portal. There is no grace exercise. Buy an overage credit at the tier's marginal rate, or move up a tier.
No. A fork branches a completed turn into an independent session so you can run the counterfactual, and it does not consume quota. Charging twice for one exercise's what-if would be hostile.
No. Reading and exporting an exercise you have already run is not a paid feature. Reading the report, exporting the whole record as JSON, reading state and deleting a session all work on every tier and in every subscription status, including past due and cancelled. The only thing a lapsed or over-quota organisation loses is the ability to start a new exercise — which is also the only thing that costs us anything.
One complete exercise: a real game master, a real timeline, and a real after-action report with the full control-coverage matrix and the evidence links intact. The gate is format, not substance — free returns the report as JSON, not as the Word file a consultant edits or the PDF that gets filed. You see exactly what you would be buying, and you cannot file it.
Full refund within 30 days if no exercise has been started. Once an exercise has run and a report has been issued there is no refund — the deliverable was delivered. Cancellation stops the renewal and does not claw back a report you are still holding, so there is no pro-rata on a mid-term cancellation.
A Team subscription is $2,400 per exercise against a $10,000–$25,000 engagement, so the arithmetic is not subtle. What you give up is a senior practitioner's judgment in the room. Co-pilot mode exists because for many buyers that judgment is the entire point: the game master proposes and the human decides, so the product is the consultant's instrument rather than their replacement. That is also why there is a partner ladder.
Nine: SOC 2, ISO/IEC 27001, NIST CSF 2.0, PCI DSS, HIPAA, EU DORA, NIS 2, CMMC with NIST SP 800-171, and ISO/IEC 27035. The report groups coverage by framework and states the count against each — "PCI DSS: 5 of 5" — with that framework's testing obligation, the clause behind it and its caveats printed beside the group, in the JSON, the Word file and the PDF. Read the next answer before you buy on that basis, though.
No, and any vendor implying otherwise is selling you a number rather than evidence. Each scenario pack maps only the frameworks it can honestly evidence, so the framework you need decides the scenario you run: PCI DSS and DORA come from the supply-chain breach, NIS 2 from the cloud account compromise, HIPAA from the ransomware. SOC 2, ISO 27001, CSF 2.0 and ISO/IEC 27035 are in all four. If two separate regimes are driving you, that is two exercises, which is one reason the tiers are metered the way they are. The frameworks page prints the whole table.
Self-serve signup is not built yet — organisations and facilitator accounts are provisioned by hand today. Write to us using the button below and we will set yours up, including the free exercise.