After Action
Start Free
NIST 800-61 · MITRE ATT&CK · CISA Aligned

Cyber Resilience
Exercise & Advisory

Facilitated exercises and advisory for organizations. Every engagement pressure-tests how your team detects, decides, escalates, and coordinates under realistic threat conditions, then turns what happened into a scored assessment and a gap list your team can work.

Aligned to NIST, MITRE ATT&CK, and CISA guidance, and built to improve capability, not just tick a compliance box.

Here to train yourself or your team?

Run self-paced tabletops with coaching on every decision. Free for one person.

Start freeSee team plans
8

Capability areas scored per exercise

NIST 800-61 aligned

5

Core deliverables generated from one exercise

IR playbook · triage · comms · RCA · gap remediation

~72h

Typical exercise-to-AAR cycle

most engagements

12

Compliance frameworks your gaps map to

SOC 2 · NIST CSF · ISO 27001 · HIPAA

Facilitated engagements

Foundation

Cyber Readiness Assessment

$7,500

per engagement · Remote · 4h

Find out where your incident response breaks down — before a real attacker does. Half-day remote exercise with a scored capability assessment.

Deliverables

  • Threat scenario exercise design (sector-specific, MITRE ATT&CK-mapped)
  • Facilitated incident response tabletop (half-day)
  • Operational Response Capability Assessment (NIST 800-61 aligned)
  • Coordination gap analysis with escalation mapping
  • Interactive After-Action Review
  • Incident decision playbook template
  • Facilitator & participant guides
  • Written summary report with prioritized findings
NIST 800-61MITRE ATT&CKNIST SP 800-84

Outcome

Your organization sees how it actually responds to a cyber incident, with documented evidence you can show your board, insurer and regulators.

Ideal for

Organizations running their first structured exercise, meeting an annual exercise requirement, or starting a repeatable exercise program.

For the CISO

“An evidence-based view of your incident response posture that you can take to the board, your insurer and your regulators.”

Schedule a scoping call

Operational

Operational Cyber Resilience Program

$15,000

per engagement · Remote · 8h

The engagement that changes how your executives think about incident response. Custom adversary scenarios, maturity scoring, and a remediation roadmap they actually follow.

Deliverables

  • Everything in Cyber Readiness Assessment
  • Custom adversary scenario development (active threat landscape)
  • Threat actor scenario mapping (tested vs. untested TTPs)
  • Incident escalation decision tree (technical → executive)
  • Executive Response Scorecard (decision speed, quality, coordination)
  • Response Maturity Assessment (5-level model, NIST CSF aligned)
  • Crisis communication templates (ransomware, breach, disruption)
  • Response playbook recommendations with implementation priorities
  • Threat landscape report for your industry at kickoff
  • Priority advisory support (48h response)
NIST 800-61NIST SP 800-84NIST CSFMITRE ATT&CK

Outcome

Your organization moves from ad-hoc incident response to documented, tested readiness, with a maturity baseline and decision frameworks that hold up under pressure.

Ideal for

Mid-market and regulated organizations, infrastructure operators, and teams with board-level cyber risk accountability.

For the CISO

“Tested escalation paths, scored executive readiness and a maturity baseline to improve against. It turns a one-time exercise into a measurable capability.”

Schedule a scoping call

Enterprise

Enterprise Cyber Crisis Simulation

$35,000

per engagement · On-site · 8h

Put your C-suite in the room with a realistic ransomware scenario and see who leads. Full-day on-site, cross-department coordination, board-ready deliverables.

Deliverables

  • Everything in Operational Cyber Resilience Program
  • Full-day on-site crisis simulation (multi-phase, escalating injects)
  • Executive crisis leadership simulation (C-suite / board track)
  • Cross-department coordination testing (IT, legal, comms, ops, executive)
  • Ransomware business impact scenario (operational + financial + regulatory)
  • Board-level response briefing (presentation-ready)
  • Executive After-Action Report (timeline, decisions, framework scoring)
  • 60-day remediation roadmap with milestones and resource requirements
  • Regulatory framework alignment documentation
  • 30-day post-exercise advisory support
NIST 800-61NIST SP 800-84NIST CSFMITRE ATT&CK

Outcome

Your leadership team is tested in a realistic crisis, cross-department coordination is validated, and you leave with a remediation roadmap that states milestones and resource needs.

Ideal for

Enterprises, critical infrastructure operators, regulated industries, and organizations with board-level cyber risk governance obligations.

For the CISO

“The engagement you bring to the board: leadership has been tested, gaps are documented and a remediation plan with resource requirements exists.”

Schedule a scoping call

Ready to buy without a call? Book an engagement on the pricing page

Annual readiness programs

Exercises through the year, monthly advisory hours, and readiness scoring that tracks progress between exercises.

Compare annual programs

  • Readiness Baseline

    $48,000/ year

    4 exercises/yr · 2h advisory/mo

  • Cyber Resilience Program

    $96,000/ year

    8 exercises/yr · 8h advisory/mo

  • Strategic Command

    $156,000/ year

    12 exercises/yr · 16h advisory/mo

Not another tabletop vendor

What consulting firms sell vs. what After Action delivers.

Typical vendor

After Action

A tabletop exercise

A cyber resilience exercise program

A checklist of findings

An operational capability assessment

A generic report

A board-ready report with readiness scoring

One engagement

Scheduled exercises, advisory hours, and readiness tracked over time

Framework buzzwords

Findings mapped to NIST 800-61, NIST CSF, and MITRE ATT&CK

Project-based billing

An annual program with a predictable advisory partnership

How an engagement works

From scoping call to remediation roadmap.

  1. Scope & Threat Alignment

    We identify your sector threats, regulatory obligations, team structure, and exercise objectives. No generic questionnaires.

  2. Scenario Design

    Scenario development mapped to MITRE ATT&CK techniques and your operational environment: ransomware, supply chain, insider, or cloud compromise.

  3. Exercise Execution

    Facilitated tabletop or crisis simulation with structured injects, decisions captured as they are made, and gaps logged in the room.

  4. After-Action Analysis

    Findings scored across 8 capability areas and mapped to NIST and the compliance frameworks you report against.

  5. Remediation Roadmap

    Prioritized gaps with owners and recommended next steps, tracked in your portal until they are closed.

Advisory add-ons

Extend an engagement or annual program with targeted work. Each is scoped and priced on request.

Custom Ransomware Response Simulation

On request

Multi-phase ransomware scenario with business impact modeling, payment decision simulation, and recovery coordination.

Incident Response Playbook Development

On request

IR playbooks covering detection, containment, eradication, and recovery for your top threat scenarios.

Critical Infrastructure Threat Modeling

On request

Sector-specific threat model mapping OT/IT convergence risks, supply chain dependencies, and adversary targeting patterns.

Executive Crisis Leadership Training

On request

Half-day session for the C-suite on cyber crisis decision-making, media response, and regulatory communication under pressure.

Red Team Scenario Development

On request

A set of adversary emulation scenarios based on threat actors active in your sector.

Crisis Communications Strategy

On request

Communications playbook for cyber incidents: internal, external, media, regulatory, and customer notification.

Response Maturity Re-Assessment

On request

A follow-up assessment that measures capability against your initial baseline.

Ask about an add-on
Critical Infrastructure

Purpose-built for operational resilience

Designed for organizations where cyber incidents create real-world operational consequences: not just data loss, but service disruption, safety risk, and community impact.

Water & Wastewater Utilities

OT/IT convergence scenarios, SCADA compromise response, EPA and state regulatory alignment.

View sector details →

Energy & Utilities

NERC CIP, TSA pipeline directives, OT security for electric, gas, oil, and renewables.

View sector details →

Counties & Municipal Government

Multi-agency coordination, ransomware with citizen service impact, CISA alignment.

View sector details →

Hospitals & Health Systems

HIPAA incident response, clinical operations continuity, patient safety decision frameworks.

View sector details →

Insurance & Financial Services

Regulatory notification exercises, third-party risk scenarios, business continuity validation.

View sector details →

Airports & Transportation

TSA cybersecurity directive alignment, operational technology scenarios, cross-agency coordination.

View sector details →

Defense Industrial Base

CMMC-aligned exercises, CUI protection scenarios, supply chain cyber resilience, and federal mandate compliance.

View sector details →

Threat-Informed

Scenarios built from adversary TTPs targeting your sector

Operational Focus

We test real decisions: isolate the network? Notify the regulator? Talk to the media?

Framework Aligned

Findings map to NIST and the compliance frameworks your sector reports against

Program Continuity

Annual programs schedule exercises through the year so readiness grows over time

Executive Accountability

Scorecards and board reports document leadership preparedness

How organizations engage with us

A common path: start with an assessment, then build a program.

  1. Land

    Cyber Readiness Assessment

    $7,500

    First exercise. Document gaps. Build the case.

  2. Expand

    Operational Cyber Resilience Program

    $15,000

    Maturity scoring. Playbook recommendations. Executive accountability.

  3. Elevate

    Enterprise Cyber Crisis Simulation

    $35,000

    Board-level simulation. Cross-department. Remediation roadmap.

  4. Retain

    Annual readiness program

    $4,000–$13,000/mo

    Exercises through the year, advisory hours, and readiness tracking.

Common questions

What CISOs and IR leads ask before their first engagement.

How long does an engagement take from kickoff to final deliverables?

The timeline is set on the scoping call. Most of it is scheduling: getting the right people in the room and designing a scenario that fits your environment. After the exercise, the After-Action Report typically follows within about 72 hours.

We've never done a tabletop exercise before. Where should we start?

The Cyber Readiness Assessment ($7,500) is designed as a first engagement. It gives you a facilitated exercise with a scored capability assessment, not a pass/fail test, and shows you what to build next. If you want your team to practice on its own first, the free trainer is a self-run tabletop with coaching on every decision.

Do you work with our existing incident response plan, or replace it?

We work with what you have. The exercise tests your current plans, procedures, and team coordination under realistic conditions. The deliverables identify specific gaps and give actionable recommendations, not a wholesale replacement. If you don't have a formal IR plan, the exercise becomes the foundation for building one.

What makes this different from compliance-driven exercises our auditors run?

Compliance exercises check a box. These exercises build capability. Scenarios are mapped to MITRE ATT&CK techniques used by adversaries targeting your sector, and every gap is scored, assigned an owner and tracked until it is closed, so your board sees progress, not just "exercise completed."

Can we start with one department or does it need to be organization-wide?

Start with one team. A common pattern is to begin with your IT and security team, then bring in legal, communications, and executive leadership in later exercises.

How do you handle sensitive findings and exercise data?

All engagement materials, findings, and exercise data are confidential. We sign NDAs before scoping begins. Deliverables are shared only with designated stakeholders. We never reference client names, findings, or scenarios in marketing materials without explicit written consent.

What's the difference between a one-time engagement and an annual program?

A single engagement gives you a snapshot of where you stand today. An annual program gives you exercises through the year, monthly advisory hours, readiness tracking, and an advisor who knows your environment. It is how you show your board and insurers that readiness is improving over time, not just assessed once.

Do you support regulatory and insurance requirements?

Every engagement produces documentation aligned to NIST 800-61, and gaps map to 12 compliance frameworks including SOC 2, NIST CSF, ISO 27001, HIPAA, PCI DSS. After-Action Reports and readiness scores are written to serve as evidence for board governance, regulatory examinations, and cyber insurance renewals.

Ready to pressure-test your response capability?

A 30-minute scoping call is enough to design an engagement around your team and your threats.

Every After-Action Report is a roadmap. Each gap becomes a capability you can build, with us or on your own. We're building your program, not your dependency.

Schedule a scoping callTry an interactive scenario