Tabletop exercises
Pre-built table-top scenarios that launch in-platform, so you can run a realistic exercise without building one from scratch — in a clearly-marked exercise mode that never touches live cases.
Platform · Simulations
Train the team. Prove the detection.
Run tabletop exercises and red/purple-team engagements end to end in a clearly-marked exercise mode — then turn what you learned into durable detections. Rehearse without touching a live case.
Simulations is included in Pro — one tier, everything bundled
What it does
Exercise mode, end to end — and a detection at the end of it.
Red & purple team workbench
Red and purple-team engagements go live only after a leader authorises the Rules of Engagement (RoE) with a step-up sign-off. Objectives, findings and progress are then tracked in one place — so an engagement is coordinated and authorised, not run out of a doc and a chat thread.
After-action report
Every exercise produces an after-action report — what was tested, what was found, and what to fix — assembled from the record rather than written from memory afterwards.
Atomic tests for detection
Run atomic tests that feed detection-engineering outcomes, so an exercise leaves better detections behind and your ATT&CK coverage moves measurably.
Why it matters
A drill you can repeat is a capability. A drill you can’t is an anecdote.
Clearly-marked exercise mode — train without risking a live case.
Red/purple-team engagements go live only after a leader authorises the RoE with a step-up sign-off.
Tabletops, drills and atomic tests — objectives, findings and progress in one record.
After-action report assembled from the exercise, not written from memory.
Atomic tests that turn an exercise into better detections and ATT&CK coverage.