The things people ask before the first one.
Mostly objections rather than questions, which is fair — an hour of everyone's time is a real ask. If yours is not here, ask us. We would rather answer it than have you guess.
Before you run one
4 questions- Do we need someone technical in the room?
- It helps, but the drill is not aimed at them. Most of what goes wrong in the first hour is a decision nobody took, a message nobody sent, or nobody knowing who was allowed to say yes. If your IT support is an outside company, finding out they are not in the room is worth knowing — better now than during a real incident.
- We don't have an incident-response plan at all.
- Then you are the reason this exists, and you can still run it today. The setup asks whether a plan exists and the report records the answer. Organizations without a plan usually leave the hour with the outline of one, written by the people who would have to follow it.
- We're four people. Is this too much?
- No. A smaller room means one person plays two roles, which surfaces a real finding — the same person is your finance approver and your communications lead, and during an incident they cannot be both at once.
- Can we run it remotely?
- Yes. One person shares the screen the room reads; everyone else talks. The clock does not care where anyone is sitting.
What actually happens
4 questions- Is this a penetration test or a security audit?
- Neither. It is a tabletop exercise: a structured discussion, on a timer. Nothing is installed, no account is connected, no credential is requested, and nothing in your systems is touched.
- Can we pause it?
- Yes, and the clock stops properly. The time is worked out from when you started and how long you paused, so a pause or a page refresh loses nothing. What you cannot do is skip ahead to the next update. Real incidents do not wait for a room to finish talking, and that one rule is what makes the hour feel real.
- Who leads it?
- Someone from your organization. The app plays the facilitator — it keeps time, delivers each update, prompts whoever is leading, and captures what was decided — but a person still runs the room.
- What if the discussion is more useful than the schedule?
- Let it run, and pause the clock. The updates are there to keep things moving, not to be followed word for word. A room that spends twenty minutes finding out nobody can approve a payment outside office hours has had a good hour, whatever the schedule said.
Afterwards
3 questions- Who sees the report?
- You do. It is drafted from your team's own recorded decisions and debrief answers, fully editable, and exportable as a PDF. Nothing is sent to anyone unless you send it.
- Will it name people who got things wrong?
- No, and that is deliberate. Decisions are recorded against a role rather than a person, all the way through. If people expect to be named, you get a performance instead of a rehearsal, and the gaps you most need to hear about never come out.
- How often should we do this?
- Once a quarter is a realistic rhythm, with a different scenario each time. There are currently 17 to choose from, which is more than two years of quarterly drills without repeating one.
Still deciding whether it is worth the hour?
Read what the scenarios actually contain, or what we do with anything you give us. Both are more useful than a sales page.