Each tabletop is a full exercise: read the brief, work the cases, make the calls together, then sign off and record lessons learned. Play solo, or host a room and invite your team — AI teammates fill any empty seats.
Manager sign-offs: approve team closuresA planted intel advisory taught the enrichment agent that an attacker's range was a friendly scanner. For nine days the fleet closed its alerts as benign. You command the response with the team room.
File servers at fourteen branches encrypted overnight and the recovery agent is already restoring from last night's backup. You command the response with a five-seat team: recover safely, rule on the ransom and tell the right people.
A developer's cloud key sat in a public code repository for four days before someone used it to launch mining servers and read customer statements. You command a three-seat team: cut off the key, keep the evidence and decide who must be told.
A relationship manager who resigned yesterday synced 3,900 client files to a personal drive and printed the contact sheets after hours. You lead a four-seat team with HR, legal and forensics: preserve the evidence, act proportionately and keep the process fair.
A trusted vendor's signed update for the branch queue software carried a backdoor, and the patch agent has already installed it at eleven branches. You command a four-seat team: stop the spread, cut the vendor's access and work out who else is hit.