The first hour decides what the breach costs you.
Incident-response drills for NGOs
Rehearse that hour with the people who would actually be in the room. No security team, no consultant, and no $30,000 budget.
Not invented for this product. The scenarios, the hour and the report follow the same public standards that professional exercise facilitators and government agencies use — which is why the output holds up with a funder or an auditor.
- NIST SP 800-84
- HSEEP
- CISA CTEP
- NIST SP 800-61r3
- UK / EU GDPR
Why a meeting doesn't work
Talking about it isn't rehearsing it.
The updates fire on a timer. Nobody can slow them down by still being mid-sentence — which is the entire difference between a drill and a meeting.
Without a drill
A plan nobody has opened since the day it was written, and no one is sure which drive it is on.
Authority discovered at 2am — the first test of who can approve disconnecting a server is the real one.
“We'd call the IT company” holds right up until somebody checks their opening hours.
No agreed position on payment so the decision gets made by whoever is most frightened.
After one hour
Gaps surface in a room where being wrong costs nothing and everybody is watching the same clock.
Decisions recorded against roles never against names, so the report is safe to circulate internally.
A report a funder accepts with findings, corrective actions, owners and dates, exportable as a PDF.
Everything closed before anyone stands — each finding leaves the room already owned and already dated.
How the hour goes
You lead the room. The app keeps the time.
- 10 minutes
Set the room
Pick a scenario, name who would really be there, answer five questions about what you already have.
- 60 minutes
Run the hour
Updates arrive on the clock, not when the talking stops. You lead; the app keeps time and captures decisions.
- Same afternoon
Send the report
Findings, owners and dates, drafted from your team's own words and exportable as a PDF.
Update 3 of 11 in “Someone else is speaking as you”, one of the 10 scenarios your team can pick from. This is exactly what appears on the shared screen at minute 9, word for word, with the clock running.
Someone else is speaking as you
next in 06:00
09:00
For the Brand & Communications
You are locked out
The Communications lead tries to sign in to the social account to take the post down. The password no longer works. The recovery email and phone number on the account have both been changed to addresses nobody recognizes.
The library
10 scenarios, written not generated.
Every legal deadline is cited by article. The model tailors wording to your organization; it cannot invent a clock, move one, or write a scenario.
Ransomware
The shared drive is gone
60 min10 updates
Business email compromise / payment fraud
The bank details changed
60 min9 updates
Device seizure or loss with beneficiary data
The laptop didn't come back
60 min9 updates
Cloud account takeover
Someone else is signing in as the Director
60 min11 updates
Departing-staff insider access
She left on Friday. Her access didn't.
60 min10 updates
Vendor or implementing-partner breach
Our data, their breach
60 min10 updates
Messaging account compromise
That message isn't from the Director
60 min10 updates
Mobile-money and payment-list fraud
The transfers went to the wrong phones
60 min10 updates
Public platform and social account takeover
Someone else is speaking as you
60 min11 updates
Accidental disclosure of personal data
It went to the wrong list
60 min11 updates
Pricing
Published, not hidden behind a demo.
An organization that has to put a figure in a grant budget should not have to book a call to find one. Numbers are being finalized — until then, ask and we will tell you.
Free
Coming soon
One drill, run solo, so you can see the report before you decide anything.
Organization
Coming soon
Unlimited drills, the full library, report exports and action tracking.
Funder or network
Coming soon
Every grantee covered, plus the roll-up across your portfolio.
The report is the product
It ends in something you can send a funder.
Every finding becomes a corrective action with an owner and a due date. If your executive director wouldn't forward it unedited, nothing else about this matters.
Blameless by construction
Decisions are recorded against a role, never a name. Practice is where mistakes are free — that is the whole point of rehearsing.
A tabletop exercise — not a cyber range, not a red team. Nothing is deployed and nothing production is touched, ever.