Frequently asked questions

SecDrills is a platform for cybersecurity tabletop exercises based on the ENISA Cybersecurity Exercise Methodology. Your team plays through an attack in the browser and makes the decisions together. The results are evaluated and documented in a report that you can present in an audit.

A tabletop exercise is a crisis exercise that works through discussion. Participants respond to a simulated scenario in their actual roles. It does not test technical systems but decisions, communication and coordination in the team.

No. SecDrills is built for all roles, from management to the IT team. In every scenario each role has to make decisions that fit its job. The platform guides you through the exercise step by step.

An introductory drill is possible from 30 minutes, a typical tabletop exercise takes 60 to 90 minutes. The facilitator needs about 15 minutes to prepare. SecDrills produces the after-action report automatically, so there are no minutes to write by hand.

SecDrills follows the ENISA Cybersecurity Exercise Methodology, the European reference framework for cyber exercises. That covers planning the exercise, running it with injects, assigning roles along the ECSF and evaluating it in an after-action report with a consistent structure.

For the part that concerns exercising, yes. NIS2 Art. 21 requires regular testing of cybersecurity measures, Art. 20 requires training for management bodies. SecDrills documents every exercise with its results, and you can use this report as compliance evidence. Other obligations such as registration or technical protective measures are outside what SecDrills covers.

SecDrills supports the testing obligations of the DORA Regulation (EU) 2022/2554. Art. 11(6) requires ICT business continuity plans, response and recovery plans and crisis communication plans to be tested at least yearly. Art. 25 explicitly names scenario-based tests as part of the testing programme. The after-action reports document the exercise results for audits.

Yes. The report contains the exercise metadata, the participant list with ECSF roles, the results per topic, a regulatory mapping and recommendations. You export it as PDF, Word or HTML and hand it to the auditor. Export is not included in the free demo drill.

1. The facilitator creates a session and picks a scenario. 2. Each participant receives their own link and joins through it. 3. The exercise runs through injects, that is new situation updates the team responds to. 4. After the last decision SecDrills produces the after-action report automatically.

Injects are events or pieces of information fed into the exercise as it runs. They move the cyber incident forward step by step, and the team has to decide how to respond each time. Every inject is assessed according to the ENISA methodology.

SecDrills offers more than 25 scenarios at three difficulty levels. They are based on the ENISA Threat Landscape report: ransomware, supply chain attacks, DDoS, phishing, attacks on critical infrastructure, insiders and more. Essentials and Professional include all scenarios. The Free demo drill includes one demo scenario, the Drill Pass covers one scenario of your choice. New scenarios are added monthly.

Yes. Besides the team exercise there is a solo mode: SecDrills guides you through a scenario on your own. That suits individual training or preparing for a team exercise.

Free demo drill: free, to try it out. Drill Pass: €490 one-off for a single exercise, the after-action report is available for 30 days. Essentials: €1,490 per year, with 3 exercise participants and report export. Professional: €4,900 per year, with up to 10 exercise participants, report export and evidence packs for ISO 27001 and NIS2. Group: for group-wide roll-outs, on request. Prices in EUR, net of VAT.

The Free demo drill costs nothing. You get one login (1 user), one demo scenario and solo mode. That shows you how an exercise runs without committing. Export of the after-action report is not included in the demo drill.

Professional costs €4,900 a year (net). It includes up to 10 exercise participants, all scenarios, solo and team mode, report export as PDF, HTML or DOCX, evidence packs for ISO 27001 and NIS2 and priority support. You can add the Guided Exercise (€3,900 one-off): our team then facilitates one exercise for you from start to finish.

Yes. For group-wide roll-outs with several tenants, SSO, custom scenarios and an SLA there is the Group plan on request. Write to hello@secdrills.com.

Yes. You cancel your subscription at any time in the customer portal. It then runs until the end of the current billing period.

A cyber crisis exercise (also called a crisis simulation) is a tabletop exercise about a serious cyber incident, for example a ransomware attack that halts production. What is rehearsed are decisions, escalation, the work of the crisis team and communication under time pressure. SecDrills models such scenarios with injects and evaluates them according to the ENISA methodology.

A tabletop exercise works through discussion and tests a team’s decisions, procedures and communication. A penetration test (or red team test) checks the technical security of systems. The two complement each other: NIS2 and DORA generally call for several types of test, that is technical tests plus a rehearsed response by the team.

NIS2 requires regular testing of cybersecurity measures but does not set a fixed interval. Exercises at least every six months, ideally every quarter, have proven sensible. Add exercises after major changes to systems, to the team or to the threat landscape.

The MSEL is the ordered list of all planned events (injects) of an exercise, each with its timing, exercise objective and expected response. It is the facilitator’s script. With it the facilitator makes sure that all learning objectives come up and are documented in a traceable way.

The after-action report is the evaluation after an exercise. It contains the results per topic with a RAG status (traffic light), lessons learned, prioritised improvement actions and a regulatory mapping to NIS2 and DORA. SecDrills produces it automatically. You export it as PDF, Word or HTML and present it in the audit.