Practice incident decisions before the real day

Response Rehearsal

Choose the format

Practice incident decisions before the real day.

Pick a format for the meeting you need to run. The packet builder is best for a full tabletop package, interactive rehearsal is best for live decision practice, slides are best for remote facilitation, and the worksheet is best when you only need a clean scribe surface.

Full packet is the safest default when you need participant and facilitator material.

Demo run

Executive payment request drill

Load a ready-to-review BEC scenario with the interactive runbook, facilitator pre-brief, live inject controls, and after-action export path already selected.

Build the packet

Exercise settings

Presentation participation

Generated packet

Ransomware Disruption Tabletop

Configure the exercise settings and generate a meeting-ready packet.

Exercise Profile

Use Note

This packet is for educational tabletop exercise planning. Customize it to local policies, systems, roles, and reporting requirements before use. It is not legal, compliance, or incident response advice.

Interactive decision rehearsal

Microsoft 365 Account Compromise

Step through a short branching scenario. Choose a response at each inject, watch the readiness meters move, and review the after-action reveal.

Choose a scenario to rehearse.

Facilitator runbook

Prep, run, capture, close.

Ready to prepare.

  1. 1. Select Choose a scenario from the picker.
  2. 2. Pre-brief Copy the facilitator pre-brief and stage materials.
  3. 3. Run live Use timer, inject copy, notes, and choices during the session.
  4. 4. Close out Complete the path to unlock the after-action report export.
Facilitator timer 60:00 Ready

Ready

Credential phishing / account compromise

Use this mode when you want the team to make decisions instead of only discussing a linear packet.

Built for a small hybrid software company using Microsoft 365, customer demos, executive participation, and a 60-minute facilitation window.

Participant content

Participant Handout

Share this portion with participants before or during the exercise. It includes the scenario setup, starting facts, ground rules, objectives, agenda, and expected roles. It does not reveal future injects.

Scenario Brief

Initial Conditions

    Ground Rules

      Assumptions to Validate

        Exercise Objectives

          Meeting Agenda

            Participant Roles

              Facilitator content

              Facilitator Guide

              Keep this portion with the facilitator and scribe. It includes scenario variables, injects, prompts, expected decision points, evidence needs, and after-action material.

              Scenario Variables

              Phase Objectives

                Inject Timeline

                  Discussion Prompts

                    Expected Discussion Areas

                      Facts, Assumptions, Decisions, Questions

                      Known Facts Assumptions Decisions Open Questions

                      Key Decision Points

                        Stakeholder Messages

                          Communications Checklist

                            Watch For Gaps

                              Facilitator Notes

                                After-Action Prompts

                                  Evidence Prompts

                                    Evidence Checklist

                                      Decision and Action Tracker

                                      Item Owner Due Status / Notes

                                      Scribe worksheet

                                      Blank Facilitator Worksheet

                                      Facts, Assumptions, Decisions, Questions

                                      Known Facts Assumptions Decisions Open Questions

                                      Decision and Action Tracker

                                      Item / Decision Owner Due Status / Notes