Strategic and Crisis Advisory
One realistic scenario, your own people, in your own boardroom. We record what was decided, who had the authority to decide it, and how long each decision took. The elapsed time is the finding.
Everybody agrees the plan should be tested and nobody has tested it, because an exercise looks like a day out of the business to confirm what people already believe.
Almost every response stalls at a decision nobody present has permission to make. That point is invisible in normal operation, because in normal operation nobody is asked.
How long the room took to decide each thing. "The decision to disconnect took 34 minutes" is a sentence a board and an insurer both understand.
The most common stall is somebody waiting for permission nobody in the room could give. That is a governance finding and it is cheap to fix once named.
Every exercise surfaces at least one. Nothing else does, because in normal operation nobody is asked.
We read your incident plan, your IT contract and your insurance policy. Two of those change the exercise, and neither is usually thought of as a security document.
Written to your systems, your suppliers and your customers. A scenario mentioning something you do not own tells everyone in the room it was not prepared for them.
Injects on a clock, each forcing one decision. We do not help. The silence where somebody should know what to do is the finding.
Fifteen minutes of debrief in the room while it is fresh, captured as people said it. A week later the answers are tidier and less true.
An exercise can be run as a training event, where the facilitator steers the room to the right answer and everybody leaves reassured. That is not this.
The scenario is written to your systems, your suppliers and your customers, because one mentioning something you do not own tells the room it was not prepared for them. The injects run on a clock and each forces one decision.
We record the decision, who had authority to make it, and how long it took. The decision to disconnect took thirty-four minutes is a sentence a board and an insurer both understand, and it is not a sentence anybody can produce by reading a plan.
Elapsed time per decision turns response readiness into something comparable next year and legible to a board.
The most common stall is somebody waiting for permission nobody present can give. Naming it is cheap; discovering it live is not.
How you handle the first day decides what customers and regulators remember. That is reputational capital, and it is spent or preserved in hours.
An untested plan is an assumption with a cover page. One exercise converts it into something you know the limits of.
You tell us what prompted the question. A customer questionnaire, an insurer, a board, or a date somebody gave you.
Thirty to forty-five minutes establishing what applies to you and what does not. Not charged, and not a sales call: if the answer is that you need less than you thought, or somebody else entirely, we say so.
What is in, what is out, what you have to supply, the fee and the end date. Nothing starts until you have it in writing.
Delivered against that scope. If something has to change, we agree it in writing first, including what it costs.
The deliverables, plus the evidence and the method, so the work can be repeated by somebody who is not us.
Fixed fee against an agreed scope. Nothing is billed hourly and the scope does not move without your written agreement. The fee is quoted rather than published, because a number carrying an asterisk is worth less than a straight answer, and scope is what decides it. You own the output. Editable files, no platform, no license, no lock-in.
Ninety minutes to two hours, scoped to the scenario. Longer exercises mostly test patience.
The people who would actually decide, including whoever can authorize disconnecting a production system and whoever speaks to customers. An exercise run by people who would not be in the real room tests nothing.
Yes, or inside the readiness engagement. On its own it runs against your existing plan, which is a fair test of that plan.
The output is about decisions and authority, not individuals. Where a person could not act because nobody had given them the authority, that is a governance finding and it is written as one.
Score your people, name individuals, or steer the room toward the answer we expected. A facilitated exercise that always ends well has established nothing.
Take the free incident response plan first. Filling it in tells you most of what an exercise would, and if you complete it and still cannot say who is allowed to disconnect a production system, the exercise has answered its own question before you paid for it.
Related services: Incident Response Planning and Readiness · Phishing Simulation · Cybersecurity Program Development