CritResponse
Cybersecurity tabletop exercises

Rehearse the breach before it happens.

A CritResponse facilitator runs a live incident as a card game. Your IT lead, leadership, legal and communications staff each hold the moves only their role can make, and the whole table has to work together to contain the attack.

Book an exercise See how it works
NIST CSF 2.0 NIST SP 800-61 MITRE ATT&CK SOC 2 · HIPAA · Cyber insurance evidence
How it works

A real incident, played out around one table.

Everyone joins from a browser with a room code. No installs and no accounts for your staff. It works in a conference room with a projector or fully remote.

01 · THE THREAT

The facilitator deals the attack

Attacks follow real techniques: phishing, a compromised remote-support tool, ransomware, data theft, wire fraud. Injects add pressure as the clock runs: a reporter calls, the owner is unreachable, the backups are hit too.

02 · THE RESPONSE

Your team plays its hand

Each role holds different cards, so Legal can't isolate a laptop and IT can't notify regulators. Budget, staff and time are limited, so every round forces trade-offs and real conversation about who does what.

03 · THE EVIDENCE

You get the after-action report

Every decision is timestamped. When the session ends you receive a report showing what worked, how fast each role responded, and exactly which capabilities your team reached for but didn't have.

The part that matters

Find the gaps while it's still a game.

Before the session, we record which protections you actually have: EDR, immutable backups, MFA, an incident response plan, cyber insurance, an IR retainer and more.

If your team reaches for something you don't have, the card is locked. They can flag it with "We'd need this." Every one of those moments goes into the report, with who needed it, against which attack, and what to do about it.

Locked cards

Missing protections show up in your team's hands, not in a checklist.

Response timing

Time from each attack and inject to each role's first action.

Remediation

Each gap comes with a concrete, prioritized recommendation.

Participation

See which roles engaged each round, and which went quiet.

After-action report

Evidence you can hand to an auditor.

Many security frameworks, regulators and cyber insurers expect you to test your incident response plan. The report documents that you did, who took part and what you learned.

  • Executive summary — reviewed by your facilitator before it's finalized
  • Round-by-round outcomes and Org Health impact
  • Gap analysis with recommended remediation
  • Response latency per round and per role
  • Framework mapping to NIST CSF 2.0, NIST SP 800-61 and MITRE ATT&CK
  • Full timeline and raw event log, delivered as a PDF
Who plays

The people who'd be on the phone at 2 a.m.

An incident is never just an IT problem. Each seat at the table has its own deck, so the exercise only works when people talk to each other.

node-01

IT Admin

Isolate hosts, disable accounts, block indicators, restore systems.

node-02

Security lead

Declare severity, invoke the plan, engage responders, hunt.

node-03

Legal

Notify the insurer, engage counsel, assess notification duties.

node-04

Executive

Authorize spend, set the ransom position, activate continuity.

node-05

Comms / PR

Hold the media, script customer calls, reach staff out of band.

Optional seats for your managed IT provider, HR, finance and front office.

Dental practicesOptometryMedical officesProfessional servicesSmall and mid-sized businesses
FAQ

Questions teams ask first.

Does my team need to be technical?

No. Each role's cards describe real actions in plain language. Executives, legal and communications staff play alongside IT, and the exercise is designed so their decisions matter as much as the technical ones.

Do participants need accounts or software?

No. Participants open a browser, enter the room code, type a first name and pick a role. We don't collect participant email addresses.

Can we run it in person and remote at the same time?

Yes. Put the shared table on a conference-room screen in projector view, and let each person play their hand from a laptop or tablet, wherever they are.

Who runs the session?

A CritResponse facilitator. They choose the scenario, deploy attacks and injects, keep time, and judge what your team's decisions are worth. The game proposes outcomes; the facilitator always has the final say.

What happens to our information?

Your security gaps are sensitive, and we treat them that way. Hidden information is enforced on the server, reports are encrypted at rest, and access is limited to CritResponse staff working with you. See our privacy notice.

Can we run exercises ourselves?

Yes. With a company account, your own staff can create and facilitate sessions for your organization, using the same scenarios, cards and after-action reports. Your company admin manages who has access.

Is this a replacement for a penetration test or audit?

No. A tabletop tests your people, decisions and plans, not your systems. It complements technical testing, and the report shows where to focus next.

Get started

Run your first exercise.

Tell us a little about your organization. We'll reply with a scenario that fits and next steps.

  • Facilitated sessions run by a CritResponse facilitator
  • Company accounts so your own team can run exercises
  • Have a room code? Join a session

We use your details only to reply to you. See our privacy notice.