Retainer capacity is full until mid-2027.Fixed-scope projects available on request.
Tabletop Exercises
A simulated cyber incident, played out in one afternoon. Your team makes the decisions, and the gaps show up while they are still cheap to fix.
- 2-4 h session
- 4-12 per team
- CZ / EN
- from €2,500
This exercise can be booked on its own, or scheduled for you inside the Retained Security Partner retainer at the point where it adds the most.
The Problem
An incident plan nobody has rehearsed
- Nobody is sure who declares the incident, who calls the lawyer, who tells customers.
- Escalation lives in one person's head. Decisions that need minutes take hours.
- "Do we pay?" gets debated for the first time under real pressure.
ISO 27001 ISO 27001 The international standard for an information security management system. It expects incident response arrangements to be tested and improved over time. and the CIS Controls CIS Controls A prioritised set of practical safeguards. Control 17 covers incident response management and expects regular response exercises. both expect incident response to be exercised as well as documented. Where NIS2 NIS2 An EU directive that raises security duties for many medium and large companies. Management approves and oversees incident handling and can be held personally accountable. applies, management is accountable for it.
The Exercises
Choose your exercise
Executive Tabletop
For boards and leadership teams
- The ransom decision
- Disclosure to customers & regulator
- Statement to the press
Operational Tabletop
For IT and security teams
- Escalation & triage choices
- Handover between IT and management
- Evidence or fast recovery
Tailored Tabletop
For any team, any seniority
- Mixed groups, cross-department
- 4-12 per team, parallel teams
- Objectives set at scoping
Non-profits: pro bono or discounted exercises are possible for selected organisations. Ask.
Scenarios
Known attack paths, played on your organisation
Most incidents follow well-known paths. We play them out on your organisation, adapted to your size, teams and systems.
Ransomware
Systems encrypted, deadline running. Who decides - and what do customers hear on day one?
Supply chain compromise
Your key vendor is breached. What do your contracts give you - and what is plan B?
Data breach
Personal data gone, the 72-hour GDPR GDPR The EU data protection law. A breach of personal data may have to be reported to the supervisory authority within 72 hours, and affected people may have to be informed. clock running. Legal, comms, and investigation compete for the same people.
Departing insider
An admin leaves on bad terms. What can they still reach, what did they take - and who notices?
Deepfake & AI abuse
A fake video of your CEO is spreading - and a cloned voice is asking finance to pay. Reputation first, fraud close behind.
Your scenario
The incident that worries you most - built from your environment at scoping.
Delivery
How the exercise runs
We run the exercise on a dedicated platform that keeps the scenario moving and records every decision for the debrief.
Timed injects
An inject Inject A scripted development delivered during the exercise: an email, a call, a media report. Injects move the scenario forward and force the team to react, just as a real incident would. (an email, a call, a media report) arrives on a set timeline, at the pace of a real incident.
Every decision logged
Responses, decisions, and timing captured as the exercise runs.
Parallel teams
Teams of 4-12 play the same scenario, compared side by side.
Objective debrief
Where time was lost, which decisions stalled, what nobody noticed.
Preferred for executive groups. Travel is billed separately.
Suits smaller exercises and remote teams, who practise in the tools they would use in a real incident.
Method: Aligned with NUKIB NUKIB The Czech national cyber and information security agency. & ENISA ENISA The EU Agency for Cybersecurity, which publishes guidance on running cyber exercises. exercise guidance
Requirements
Inputs we need from you
A sponsor and objectives. One scoping call settles what the exercise tests.
The right people in the room. Those who would own the incident, 4-12 per team.
Honest input on how things work. Key systems, suppliers, decision-makers.
Book at least one month ahead. Scenario and inject design take time.
No incident response plan yet
A first exercise shows what your plan has to contain. If you already have one, it shows where to revise it.
Pricing
Indicative pricing
excl. travel
What affects the final price
Group Size & Parallel Teams
One team of 4-12 is the baseline; each extra team adds facilitation and debrief work.
On-site Travel
Flights, hotel and travel time are billed separately. Combining the exercise with other on-site work keeps that cost down.
Scenario Depth 1 month lead time
A single-thread scenario costs less than a deep simulation of your suppliers and media pressure.
Process
How We Collaborate
Objectives, audience, format, language. 30 minutes, free.
Written from your systems, suppliers and decision chain, which is what the month of lead time is for.
2-4 hours, facilitated. Injects on a timeline, decisions logged, hot debrief at the end.
After-action report with prioritised fixes, plus a follow-up call a few weeks later.
After the Exercise
The findings need an owner
An exercise almost always surfaces gaps in incident response. The after-action report turns them into a prioritised fix list, and your team decides what to do with it.
If you want help, the Retained Security Partner retainer works through the list with you at a pace you set.
Get started
Scope an exercise
Hands-on labs or workshops instead? See Training & Workshops.
Whole-workforce behaviour change? See the Human Risk Programme.