Questions
The things people ask before the first one.
Mostly objections rather than questions, which is fair — an hour of everyone's time is a real ask. If yours is not here, ask us; we would rather answer it than have you guess.
Before you run one
- Do we need someone technical in the room?
- It helps, but the drill is not aimed at them. Most of what fails in the first hour is a decision nobody owned, a message nobody sent, or an authority nobody could locate. If your IT support is an outside company, their absence is itself something worth discovering during a rehearsal rather than during an incident.
- We don't have an incident-response plan at all.
- Then you are the reason this exists, and you can still run it today. The setup asks whether a plan exists and the report records the answer. Organizations without a plan usually leave the hour with the outline of one, written by the people who would have to follow it.
- We're four people. Is this too much?
- No. A smaller room means one person plays two roles, which surfaces a real finding — the same person is your finance approver and your communications lead, and during an incident they cannot be both at once.
- Can we run it remotely?
- Yes. One person shares the screen the room reads; everyone else talks. The clock does not care where anyone is sitting.
What actually happens
- Is this a penetration test or a security audit?
- Neither. It is a tabletop exercise: a structured discussion, on a timer. Nothing is installed, no account is connected, no credential is requested, and nothing in your systems is touched.
- Can we pause it?
- Yes, and the clock stops properly — elapsed time is derived from when you started and how long you paused, so a pause or a browser refresh loses nothing. What you cannot do is advance to the next update early. Real incidents do not wait for a room to finish talking, and that single constraint is what makes an hour feel real.
- Who leads it?
- Someone from your organization. The app plays the facilitator — it keeps time, delivers each update, prompts whoever is leading, and captures what was decided — but a person still runs the room.
- What if the discussion is more useful than the schedule?
- Let it run and pause the clock. The updates are a spine, not a script. A room that spends twenty minutes discovering nobody can authorize a payment out of hours has had a good hour, whatever the schedule said.
Afterwards
- Who sees the report?
- You do. It is drafted from your team's own recorded decisions and debrief answers, fully editable, and exportable as a PDF. Nothing is sent to anyone unless you send it.
- Will it name people who got things wrong?
- No, and not by accident. Decisions are recorded against a role rather than a person, throughout. A drill where people expect to be named produces a performance instead of a rehearsal, and the gaps you most need never surface.
- How often should we do this?
- Once a quarter is a realistic rhythm, with a different scenario each time. There are currently 10 to choose from, which is more than two years of quarterly drills without repeating one.
Still deciding whether it is worth the hour?
Read what the scenarios actually contain, or what we do with anything you give us. Both are more useful than a sales page.