From a 15-track regional cyber exercise to an automated After-Action Report — in 72 hours, not six weeks.
A major U.S. metropolitan region ran a full-scale, multi-jurisdiction cybersecurity tabletop against an AI-enabled adversary. This is what happened to the exercise data afterward.
The scope — the hard tier of this work
- 15
- Jurisdiction / sector tracks
- 222
- Injects authored and delivered
- 60
- HSEEP-aligned objectives
- 6
- IR-lifecycle phases covered
4 per track
detection → legal / regulatory
- Detection
- Escalation
- Containment
- Communications
- Recovery
- Legal / regulatory
The situation
A major U.S. metropolitan region ran a full-scale, multi-jurisdiction cybersecurity tabletop exercise: an AI-enabled adversary mounting a coordinated disinformation-plus-critical-infrastructure campaign — deepfake public-official messaging, manipulated transit and travel data, and intrusions spanning city IT, water/SCADA, 911 dispatch, healthcare and vendor supply chains, airport and port operations, EV-charging and transit systems, and emergency alerting. The exercise was designed and authored by After Action's founder.
The problem with how this normally ends
A regional exercise this size generates enormous signal — dozens of decisions per track across six phases of incident response — and then it dies in a survey tool and a slide deck. The After-Action Report takes weeks of manual synthesis, arrives after the urgency has faded, and can't be compared across jurisdictions or re-scored next quarter.
What After Action did with it
The entire 15-track, 222-inject program was ingested into the platform, which then generated — from the exercise data, with no manual writing — a structured After-Action Report, an 8-dimension readiness score (NIST 800-61 aligned) per track, a prioritized gap tracker with framework mappings, and the full set of derivative deliverables: IR playbook, triage checklist, crisis-comms plan, root-cause analysis, and gap-remediation plan.
Turnaround measured in hours, not weeks — the same engine that lets a $7,500 engagement deliver a board-ready report in 72 hours.
Why it matters
The legacy stack for regional exercises — a slide builder plus a survey form — can record what happened. It cannot score readiness across eight dimensions, map gaps to NIST CSF / CIS / the frameworks auditors ask for, or produce a comparable baseline you can re-run next quarter. After Action does all three, automatically, at the scale a 15-jurisdiction region actually operates at.
Client anonymized. Figures are platform-record counts from the ingested exercise (tracks, injects, objectives). The readiness-scoring demonstration was run on a clearly labeled simulated session, so this page describes capability, not a measured client improvement.
Run the same class of exercise.
One half-day session. Within 72 hours: the AAR, five derivative deliverables, an 8-dimension readiness score, and every gap mapped to your frameworks. From $7,500, fixed.