Your team rehearses the incident.
SecDrills writes the audit evidence as you go.
When did your team last rehearse a serious incident, and where is that documented? With SecDrills you play through an attack scenario in the browser. At the end you have a report with roles, decisions and timestamps that you can hand straight to the auditor.
The check takes two minutes and needs no sign-up. Or first see how an exercise runs.
SecDrills is a SaaS platform from Austria for cyber tabletop exercises (crisis simulations) based on the ENISA exercise methodology. It is built for mid-sized organisations across the EU that fall under NIS2 or DORA, and for their international sites. The after-action report is produced automatically and serves as evidence for NIS2, ISO 27001, DORA and TISAX. Hosting is in the EU, in a Frankfurt data centre.
Why the crisis exercise keeps getting postponed
It is rarely a lack of will. Usually it is one of these four points.
The auditor wants evidence
They ask when you last rehearsed a serious incident and where that is documented. A photo of the flipchart is not enough.
Preparation takes weeks
Build the scenario in PowerPoint, book a facilitator, align ten calendars and write the minutes afterwards. The exercise easily slips into the next quarter.
Nobody knows exactly who decides
Who takes the systems offline? Who reports to the authority, and by when? That should be settled before the attack.
The documentation helps nobody
Handwritten notes and half-finished minutes show neither the team what to improve nor the auditor that the exercise took place.
What SecDrills does differently
The report is ready when the exercise ends
Every assessment, every decision and every role is recorded with a timestamp. No retyping into Excel.
Ready-made scenarios, guided process
You pick a scenario and send your team a link. SecDrills guides the exercise, so you do not need an external facilitator. A short exercise takes 30 minutes.
Exercise as often as you like
The annual packages already include further exercises. You can bring in new colleagues, play other scenarios and see whether your team is getting better.
How an exercise runs
You need a browser and your usual video call. Nothing is installed.
Pick a scenario
The facilitator picks a scenario and invites the team by link. Participants do not need an account.
Play together
Everyone opens the link in the browser. You talk as usual in Teams or Google Meet.
Decide
The situation escalates step by step. Everyone gives their assessment, then the group agrees on a decision.
Download the report
After the last decision the report is ready: roles, answers, discussion outcomes and timestamps, as PDF, Word or HTML.
Traditional workshop or SecDrills
Most teams compare SecDrills with the workshop they have run so far. Or with the one they have been putting off for a year.
| Criterion | Traditional workshop | SecDrills |
|---|---|---|
| Preparation | Build the scenario yourself, brief the facilitator, align diaries | Pick a ready-made scenario, send a link |
| Documentation | Minutes written afterwards, often incomplete | The report is produced during the exercise |
| In the audit | Hard to prove | Report with roles, decisions and timestamps |
| Cost | €5,000 to €15,000 per externally facilitated exercise | Included in the annual package, from €1,490 a year |
| Frequency | Once a year, if at all | As often as you like |
Scenarios from everyday life in mid-sized organisations
The scenarios follow the ENISA Threat Landscape. What you rehearse are the decisions of the first hours: shut systems down or keep them running, whom to inform, what to report.
Ransomware in the production network
ADVANCEDERP and manufacturing are encrypted and the ransom demand has arrived. Who decides, who reports?
Compromised software supplier
ADVANCEDA tampered update from your service provider opens the door. How do you contain the damage?
Phishing in accounting
BEGINNEROne click and the credentials are gone. Management has to act.
CEO fraud / whaling
INTERMEDIATEA payment instruction in the name of the managing director. Do your controls hold?
Data leak at an automotive supplier
INTERMEDIATECustomer data of an OEM is affected and the TISAX reporting deadlines are running.
IT service provider outage
BEGINNERYour managed service provider is offline. How do you keep operating?
What each role gets out of it
IT and security leads
You run the exercise without spending a week building scenarios first. Afterwards you have a report instead of scattered notes.
Learn moreISMS and compliance
You get the evidence the auditor wants to see, with date, roles and decisions. It is ready as soon as the exercise ends.
Learn moreManagement
You know who decides what in an emergency and meet your duties as a management body. The cost is a fixed annual amount.
Learn moreConsultants and auditors
You offer your clients tabletop exercises without designing a new workshop every time. The report is included.
Learn moreOne report, four frameworks
NIS2, ISO 27001, DORA and TISAX all require you to test your emergency procedures. The exercise report serves as evidence for all four.
NIS2
Directive (EU) 2022/2555
Applies across the EU through national transposition laws. Art. 21 calls for regular testing of your cybersecurity measures, Art. 20 puts the management body in charge.
Learn moreISO 27001
A.5.24–5.30
Requires that incident response and continuity measures are tested. The exercise report is the evidence for the internal audit.
Learn moreDORA
Regulation (EU) 2022/2554
Requires scenario-based tests of ICT business continuity plans and crisis communication in the financial sector.
Learn moreTISAX
Automotive
Suppliers must show that their emergency and incident processes have been rehearsed. The report can be presented directly.
Learn moreMethod by ENISA, roles by ECSF
The exercises follow the Cybersecurity Exercise Methodology of ENISA, the EU Agency for Cybersecurity. Roles are assigned along the European Cybersecurity Skills Framework (ECSF). Both are European reference frameworks that auditors know.
ENISA Cybersecurity Exercise Methodology
- Exercise cycle of planning, delivery and evaluation
- The scenario develops through injects, that is new situation updates
- After-action report with a consistent structure
- Assessment of responses against a fixed scheme
European Cybersecurity Skills Framework
- Role profiles such as CISO, incident responder or threat intelligence analyst
- Everyone exercises in the function they hold in a real incident
- Evaluation per role
- EU competence framework published by ENISA
What your IT and data protection teams want to know
- Runs in the browser, on tablets too. Nothing is installed.
- SecDrills needs no access to your systems or networks.
- Hosted in the EU, in a Frankfurt data centre. Processing complies with the GDPR.
- Participants do not need an account, an invitation link is enough.
Who is behind SecDrills
SecDrills is developed and operated by BlueGravitas GmbH in Voitsberg, Austria. The managing directors are Thomas Kutschi and Herwart Wermescher. If you have a question, write directly to hello@secdrills.com.
More about usWhat SecDrills costs
An externally facilitated exercise usually costs €5,000 to €15,000. With SecDrills your team exercises for a whole year for a fraction of that. There is a free demo drill to try it out. Prices in EUR, net of VAT.
Free demo drill
€0
Drill Pass
€490
one-off
Essentials
€1,490
/ year
Professional
€4,900
/ year
Group
On request
NIS2 and DORA: what applies to you?
Does NIS2 apply to our organisation?
NIS2 (Directive (EU) 2022/2555) applies to essential and important entities in the sectors of its Annexes I and II, as a rule from 50 employees or an annual turnover and balance sheet total above EUR 10 million. It takes effect through national transposition laws, which set the registration and reporting procedures in each member state. If your group has sites in several EU countries, each entity is assessed under the law of its own member state.
What does NIS2 require in terms of exercises?
Art. 21(2) lists the risk management measures, including incident handling, business continuity and crisis management, and policies to assess the effectiveness of these measures. Art. 20 requires management bodies to approve the measures, oversee their implementation and follow training. A documented tabletop exercise shows both: the measures were tested, and the management body took part.
How do we show that crisis procedures have been rehearsed?
With a documented exercise. That includes the exercise brief, the scenario, roles, a log of the exercise, the after-action report, an action plan and the later check that the actions worked. SecDrills produces the report automatically during the exercise. It serves as evidence for NIS2 Art. 21, ISO 27001 A.5.24 to 5.30, DORA Art. 11(6) and TISAX.
More answers in the FAQ and in the knowledge section.
Take a look at an exercise
In the demo we play through a scenario with you and show you the finished report. Then you can judge for yourself whether it is enough for your next audit. We get back to you within two working days.
Request a demoPrefer to try it yourself first? The demo drill is free.