Rehearse incident response,
before the phone rings at night.
Your playbooks and escalation paths are written down. Whether they hold, you usually only find out when things are on fire. With SecDrills your team plays through an attack at the table. It decides under time pressure, escalates and communicates, and afterwards the report shows where it got stuck.
Request a demoWhat your team gets out of it
Scenarios from the threat landscape
You rehearse ransomware, supply chain attacks, DDoS or insider threats. The scenarios follow the ENISA Threat Landscape report and real incidents.
Every person in their role
Everyone exercises in the function they hold in a real incident: incident response, CISO, IT operations, legal, communications. SecDrills assigns the roles along the ECSF.
Playbooks put to the test
You test playbooks and escalation paths at the table. SecDrills needs no access to your systems or networks for that. Gaps show up in the exercise and not only in the incident.
Training scenarios for IR teams
Containing ransomware
Who takes which systems offline, who coordinates communication, who keeps an eye on the reporting deadline? The situation escalates with every inject.
Compromised service provider
A third party is compromised. How do you assess the impact, and which of your systems depend on it?
Reporting to the authorities
NIS2 Art. 23 and GDPR Art. 33: you rehearse the reporting chain with the deadlines that also apply in a real incident.
Debrief
After every exercise there is an after-action report with lessons learned and improvement actions you can implement.
Deciding under time pressure
The exercise follows the ENISA Cybersecurity Exercise Methodology. The incident develops through injects, that is new situation updates that arrive step by step. Your team has to decide each time what to do now. Ticking off a checklist is not enough.
This shows whether your playbooks and escalation paths hold. Do the runbooks work? Does every person know what they are responsible for? Does the information travel from IR through IT operations and legal to management? Whatever gets stuck here shows up in the exercise, where it costs nothing yet.
The reporting deadlines are the tricky part. The early warning under NIS2 Art. 23 is due within 24 hours of becoming aware of a significant incident, the notification under GDPR Art. 33 where feasible within 72 hours. Both run in parallel with the technical response. In the exercise you play this reporting chain through to the end.
What you take away from the exercise
Scores per topic
The report rates every topic and the quality of the decisions. Across several exercises you see where your team is gaining ground.
Concrete actions
The after-action report records what went well and what did not, and derives prioritised actions. That gives you more to work with than an impression from the round.
Solo mode
New team members exercise on their own, whenever it suits them. You do not have to gather the whole team for that.
Rehearse the incident while it is still an exercise
In the demo we play through a scenario with you. You see how the injects arrive, how you decide together and what ends up in the report. Nothing is installed, it runs in the browser. We get back to you within two working days.
Request a demo