Practice realistic cyber incidents on your own or with your team, coached on every decision. Organizations that want a facilitator in the room or a year-round program will find that under For organizations.
Train
Work through a live cyber incident one decision at a time, get coached as you go, and see where your response is strong and where it breaks. Start on your own for free; bring your team when you’re ready.
Ransomware and other real-world incident scenarios. Pick a difficulty and the areas you want to work on — detection, escalation, containment, communications, recovery, legal.
Each decision gets feedback from a facilitator engine built on NIST 800-61: what you covered, what you missed, and the question a real facilitator would ask next.
Every run scores 8 capability areas. Areas a scenario never tested say "Not tested" instead of a free 100, and the scoring method is published.
Invite teammates into one workspace. Everyone trains on the same library, and scores, gaps and reports land in one place.
Practice on your own
1 person · no credit card
Create a free account and run the ransomware trainer: a three-stage incident where you make the call at each stage.
Not ready for an account? Try one of these first — no signup:
Train your team
up to 10 people · billed monthly · cancel anytime
You and up to 9 teammates. Run any scenario in the library as often as you like and watch your team’s score move over time.
Train a larger team
up to 25 people · billed monthly · cancel anytime
Room for up to 25 people, the premium sector scenarios, and a monthly group office hour with a facilitator.
How the score works
The 8 areas, their weights and the caps on solo runs are documented, so you can see why a score is what it is.
Read the scoring methodBuying for an organization?
Facilitated exercises with a scored assessment, board-ready deliverables and annual readiness programs.
See pricing for organizationsFor organizations
When you need a facilitator in the room, a scored assessment your board will read, or a readiness cadence your auditors and insurer can see.
For a specific event — board exercise, post-incident drill, executive simulation. Custom scenario design, a scored maturity assessment and board-ready deliverables.
Foundation
per engagement · Remote · 4h
Find out where your incident response breaks down — before a real attacker does. Half-day remote exercise with a scored capability assessment.
Operational
per engagement · Remote · 8h
The engagement that changes how your executives think about incident response. Custom adversary scenarios, maturity scoring, and a remediation roadmap they actually follow.
Enterprise
per engagement · On-site · 8h
Put your C-suite in the room with a realistic ransomware scenario and see who leads. Full-day on-site, cross-department coordination, board-ready deliverables.
One engagement shows you where the gaps are. An annual program keeps them closed — exercises through the year, dedicated advisory hours and compliance evidence that builds up, for when your board wants a cadence, not a snapshot.
Foundation
$4,000/mo · 4 exercises/yr · 2h advisory/mo
Quarterly exercises that build muscle memory. Your team practices four times a year, tracks readiness scores, and closes gaps between exercises.
Resilience
$8,000/mo · 8 exercises/yr · 8h advisory/mo
The program that justifies your security budget. 8 exercises, executive scorecards, compliance evidence, and an advisor who knows your environment.
Maximum Readiness
$13,000/mo · 12 exercises/yr · 16h advisory/mo
Monthly exercises, a dedicated facilitator, and board-ready briefings. Your executive team practices crisis leadership until it becomes instinct.
Transparent Pricing
Most firms don't publish pricing. We do. Here's what you'd pay buying these services individually.
| Service | Market Rate | After Action |
|---|---|---|
| Single facilitated tabletop exercise | $25,000 – $40,000 | From $7,500 |
| 4 quarterly exercises (annual) | $100,000 – $160,000 | From $48,000/yr |
| vCISO / advisory retainer | $60,000 – $150,000/yr | 2–16h/mo in annual programs |
| NIST / compliance readiness assessment | $10,000 – $50,000 | Included |
Sources: PreparedEx, IBM X-Force, IANS Research, Clutch.co, Corsica Tech — March 2026
How Annual Programs Work
Every annual program follows a four-quarter cycle designed to show measurable improvement over 12 months.
Establish your readiness baseline with a threat-informed tabletop. Identify gaps. Set the benchmark.
Targeted drill on identified gaps. Measure improvement against the Q1 baseline. Adjust remediation priorities.
Escalated scenario complexity. New threat vectors. Cross-team coordination under realistic conditions.
Final assessment. Insurance readiness certificate when the score qualifies. Board-ready report. Plan the next cycle.
The Case for Continuous Readiness
One-off exercises check a box. Annual programs build real capability.
A single readiness score is a snapshot. Quarterly scoring gives you a trendline — proof that your team is getting better, not just guessing.
Annual programs let you remediate gaps between exercises instead of scrambling after a one-time assessment. Your team builds muscle memory.
Carriers want proof of ongoing readiness, not a report from 18 months ago. Annual programs build up evidence you can bring to renewal.
Give your board a consistent cadence of readiness updates, with measurable change across four data points a year.
Every tier is backed by the same methodology and the same automated deliverable engine. The differences between tiers are scope, duration and audience — not platform capability.
Methodology, not magic
Documented · Inspectable
The readiness scoring method is documented: the eight capability areas and their weights, how each gap severity lowers a score, and the caps that apply to single-participant runs and open critical gaps. Your team can check how a score is computed before they trust the number on the board slide.
Read the scoring method