01
Tabletop exercises
Rehearse a scenario with leadership and technical teams. Work through decisions, escalation paths, communications, and handoffs; document where the response plan needs to change.
Security readiness
Test the plan. Strengthen the response.
We run tabletop exercises, validate detections, and harden controls around the systems your mission depends on. Find the gaps, assign the work, and test the changes.
Readiness services
People. Processes. Technical controls.
A response depends on all three. We examine how they work together, from the first alert to the decisions and actions that follow.
02
Detection validation
Run agreed adversary behaviors alongside your defenders. Inspect SIEM and EDR telemetry, test alerts and escalation, and define repeatable checks for detection changes.
03
Architecture & controls
Review trust boundaries, segmentation, and the dependencies behind critical workflows. Identify control gaps, clarify ownership, and prioritize hardening work.
04
Identity & access
Examine privileged access, delegation, MFA, and conditional access. Connect the findings to identity incident playbooks and the controls that limit privilege abuse.
05
Cloud & endpoints
Review cloud permissions, endpoint hardening, and telemetry coverage. Check whether containment playbooks account for the systems and access your team actually uses.
06
Program governance
Give security and leadership a shared view of risk, action owners, and unresolved dependencies. Track progress through agreed reviews and evidence from retesting.
How we work
The exercise is the start.
The changes are the work.
Connect each finding to an owner, an action, and a way to check that the change works.
- 01
Baseline
Identify critical workflows, supporting systems, current controls, and the scenarios that matter. Agree on scope, participants, and operating constraints.
Outcome: Prioritized scenarios and scope.
- 02
Exercise
Rehearse decisions and test agreed technical controls. Capture what worked, where the team lacked information, and which actions could not be completed.
Outcome: Observations and validation evidence.
- 03
Improve
Turn findings into control changes, detection updates, and revised playbooks. Set owners, priorities, and acceptance criteria for the work.
Outcome: Owned engineering and response actions.
- 04
Retest
Check agreed changes against the original scenario. Record remaining gaps and update the review plan as systems, threats, and responsibilities change.
Outcome: Retest evidence and remaining gaps.
Ways to engage
Start with the work you need.
A focused assessment, an engineering effort, or recurring support. Scope, timing, and retesting are agreed around your priorities and operating constraints.
Engagement 01
Risk assessment & validation
Where should we focus first?
Establish a baseline around priority systems and scenarios. Combine review, exercises, and technical validation to make the next decisions with evidence.
- Critical workflows and dependencies
- Tabletop and control validation
- Risk priorities and action owners
The handoff
A risk baseline, validation findings, and a prioritized action plan.
Engagement 02
Security engineering
How do we close the gaps?
Work through the controls, detections, and playbooks that need attention. Define the engineering effort and how the team will verify the changes.
- Control hardening and detection tuning
- Response playbook updates
- Implementation and retest criteria
The handoff
Scoped engineering work with documented changes and validation criteria.
Engagement 03
Readiness retainer
How do we keep the work moving?
Arrange recurring advisory, exercise, and validation support. Set the capacity, review schedule, and priorities around the needs of your team.
- Reserved capacity by agreement
- Recurring reviews and exercises
- Action tracking and control refinement
The handoff
An agreed readiness work plan with continuing review and follow-through.
What you receive
Evidence, owners, and next steps.
Deliverables follow the engagement scope, with enough detail for the teams doing the work and the leaders setting priorities.
- Readiness baseline
- Priority scenarios, critical dependencies, and the controls and response workflows reviewed.
- Exercise & validation findings
- Recorded decisions, technical evidence, and gaps observed during the agreed exercises and tests.
- Owned action plan
- Engineering and playbook changes with priorities, responsible teams, and acceptance criteria.
- Retest & leadership readout
- What changed, what was checked, and which risks or dependencies still need a decision.
Before we begin
What needs to hold up under pressure?
Tell us which systems, decisions, or response workflows need attention. We will help define a practical starting point.
Plan an assessmentKeep credentials and sensitive technical material out of the initial web inquiry.
Active incident? Get response supportHow is readiness different from a penetration test?
A penetration test focuses on exploitable weaknesses in a defined scope. Readiness work also examines decisions, handoffs, playbooks, and the team's ability to use its controls. Technical validation can be part of that work, but not every readiness engagement includes a pentest.
Who takes part in a tabletop exercise?
Participants follow the scenario and your response responsibilities. That can include security, IT, engineering, leadership, legal, and communications. We agree on roles, objectives, and the exercise format during scoping.
Can we use our existing tools and playbooks?
Yes. The work starts with your environment, processes, and tooling. We review the available evidence and coordinate any agreed tests or changes with the people responsible for operating the systems.
Does this provide a compliance certification?
No. Readiness reviews can organize findings around agreed framework references, but they are not a certification, an audit opinion, or an endorsement by a standards body. Specific compliance requirements need to be discussed during scoping.
Is a readiness retainer incident response coverage?
A readiness retainer covers the preparation and validation work defined in its scope. Do not assume it includes emergency response or a response-time commitment. Incident response options and their terms are set out separately on our incident response page.
What do you need to scope the work?
Start with the systems or workflows you are concerned about, the teams involved, and any deadline or operational constraint. We agree on deliverables, access, testing permissions, timing, and retesting before work begins. Keep credentials and sensitive technical material out of the initial web inquiry.
Framework references
References inform the agreed work; they do not imply certification or endorsement.
- NIST CSF 2.0
Cybersecurity risk management
- NIST SP 800-61 Rev. 3
Incident response and risk management
- MITRE ATT&CK
Adversary behaviors for validation