Crisis Room — cyber crisis exercises

The crisis room, under real conditions.

Design, run and assess your cyber crisis exercises. One dedicated tenant per organisation, hosted in France.

Book a demoSee pricing
Hosted in France
Exercise — Ransomware / Verdal Group Live
T+00:00TECHThree file servers are not responding. .lkr extension on the shares.
T+00:06RSSIServer VLAN isolation requested. Do you confirm cutting remote access?
T+00:14COMMSA journalist is calling reception. He mentions "a major IT outage".
T+00:21LEGALThe Verdal customer contract requires notification within 24 h of an incident.
T+00:29DPOPersonal data may be affected. The 72-hour GDPR clock is running.
5 / 7 injects · 6 active roles · 14 participants online
The solution

An exercise is prepared, played and defended.

The platform covers all three stages. The facilitator stays in control, participants only see their own scope, and the timeline serves as evidence once the exercise is over.

  1. Before · Facilitator

    Prepare

    Choose a scenario from the library, by incident type and by sector. Assign a role to each participant: CISO, management, legal, communications, DPO.

    An exercise ready to launch
  2. During · Crisis team, 2 to 4 h

    Play

    Injects arrive at the planned minute or by hand. Each role receives its messages, responds and records its decisions. A pause also stops the response deadlines.

    Time-stamped decisions
  3. After · Facilitator and management

    Defend

    The facilitator scores each response against the grid. The report brings together the timeline, the decisions, the scores by area and the action plan.

    An after-action report
  • 01Scenarios

    Ready-to-play scenarios

    Ransomware, data leak, supplier compromise, IT outage. Each scenario is split into reusable building blocks that you adapt to your context.

  • 02Injects

    A timed exercise

    The facilitator triggers injects over time: emails, press calls, technical alerts, legal pressure. Each role only sees what concerns it.

  • 03Roles

    The whole crisis team, whatever its size

    Each scenario defines its own roles — from a small tabletop to an extended crisis team with remote cells. Participants join from their workstation or their phone.

  • 04Assessment

    A defensible score

    Scoring grid, time-stamped timeline of decisions, after-action report exported at the end of the session.

The product

What each role sees.

Screenshots of the platform during a demonstration exercise, for a fictitious organisation. Details are blurred; the demo shows the rest.

Facilitator console, details blurred: exercise timer, planned minute of an inject, remaining response time and participants online.

The facilitator console

  1. The exercise timer. A pause also stops the response deadlines.
  2. Each inject has its planned minute. The facilitator sends it by hand or lets it go out automatically.
  3. The response time left for the role concerned, and one-click escalation.
  4. Participants online, with their role.
View of a participant in the DPO role, details blurred: inject received with its response deadline and the crisis team's message feed.

A participant view

  1. Each participant plays a role, here the DPO.
  2. They only receive the injects for their role.
  3. The time left to respond is shown on the inject.
  4. Their decision is recorded, linked to the inject and time-stamped.
  5. The crisis team feed, shared by all roles.
Scenario library, details blurred: filters by incident type and sector, classification of a scenario.

The scenario library

  1. Filters by incident type and by business sector.
  2. Shared scenarios, and those written for your organisation.
  3. Each scenario is classified: incident type, sector, duration, number of roles.
What you get

Two deliverables at the end of every exercise.

The exercise doesn't end when the team disperses. It leaves a record you can take to the audit committee.

Scores by area for a completed exercise: governance, operations, communications, compliance. The scoring detail is blurred.

The scoring grid

Criteria are set before the exercise. The facilitator scores as the session unfolds, without reconstructing after the fact.

Header and overall score of an exercise report: 8 participants, 2 h 20, 10 decisions, 67%, "Satisfactory" level. The rest is blurred.

The after-action report

Time-stamped timeline of decisions, gaps identified, points to fix. Exportable when the session closes.

Beta

Join the beta

Version 1.0 launches in Q1 2027. Until then, we are opening the platform to a small number of organisations willing to play a real exercise and tell us what is missing. Taking part in the beta is free.

At commercial launch, those who commit for three years get preferential terms on our plans.

Closed, free beta · preferential terms with a 3-year commitment
Apply for the beta
Questions

What we are asked before signing.

How long does an exercise last?

Two to four hours for a standard exercise, including preparation and debrief. The facilitator sets the pace: injects are triggered at the tempo they choose, and they can pause the session at any time.

Is there anything to install?

No. Everything runs in the browser. Participants receive a link valid for one session and one role.

How many players can take part?

The Essentiel plan opens the exercise to 8 players from your domain and one administrator. The Cellule plan lifts this limit: every player in your domain can be invited, with two administrators. In both cases, billing is based on the annual subscription, never on the number of people invited.

Where is the data hosted?

In France. The platform is a multi-tenant SaaS: each customer organisation has a dedicated tenant, isolated from the others. Exercise data describes your information system.

Does it meet the NIS2 exercise requirement?

NIS2 requires organisations to test their crisis management arrangements and to be able to demonstrate it. Crisis Room produces the time-stamped timeline of decisions and the after-action report that make up this evidence. Compliance is still assessed by your supervisory authority, in light of your overall arrangements.

Can we play a scenario specific to our organisation?

Yes. We write the scenario, the injects and the scoring grid with you, based on your information system, your suppliers and your obligations. This option is available with any plan, on quote.

Is the product available today?

Version 1.0 launches commercially in Q1 2027. Until then, the platform is available as a closed beta to a small number of organisations, with our support.

An exercise always reveals something.

We show you the platform in thirty minutes, with a live scenario, and you leave with a quote.

Book a demo