For companies with 50 to 300 people
Your cyber insurance renewal asks if you tested your incident response plan. In 15 days, the answer is yes, in writing.
3-hr facilitated tabletop exercise for your leadership team, plus an after-action report attesting that the exercise took place. 5 hours of your team's time, start to finish.
(We reply within one business day.)
What you are actually paying for
You can generate a tabletop scenario in thirty seconds. You can generate an after‑action report template just as fast. Neither one is what your carrier is asking for.
A witness, not a document
Your carrier is not asking you to produce a report. They are asking you to demonstrate that something happened, and they want a credible third party to confirm it. Software cannot be a witness. This is why auditors still exist in a world that has accounting software.
A facilitator, not a chatbot
A chatbot can ask whether you would pay the ransom. It cannot make your CFO and your Managing Partner disagree out loud and then land on a decision. The discomfort is the product. The report is what is left over.
An outsider, not an employee
Your IT manager already knows what is broken. He cannot tell the CEO the plan does not work without it sounding like a budget request. We can, and it lands differently.
Three stages.
Before
We read your playbooks, response plans, crisis workflows and comms procedures, then build one incident around your industry, your risk profile and the plan you actually have.
Nothing off the shelf. The scenario is written around the way your team is actually supposed to work, so what it tests is real.
During
A 3-hour live, facilitated session with your executives, operations and IT working the same incident together.
That coordination is the thing your carrier wants evidence of, and the thing that fails first in a real breach.
After
A written report in 15 days: decisions made, gaps found, actions assigned, each with an owner and a date. Plus a signed attestation naming who attended, for how long, and on what date.
That attestation is the part no software can give you, and the part underwriters actually check.
The Carrier Acceptance Guarantee
If your insurer won't accept the report, we rewrite it until they do.
You are buying proof. If it does not work as proof, it is not finished.
Tabletops offered by other firms run close to six figures. Our seasoned incident response experts deliver the same quality at a much more competitive rate.
Program Tiers
Two fixed-price programs. Know exactly what you get and what it costs before you commit.
Carrier-Ready Tabletop
We build and run a tailored tabletop exercise for your leadership team, then write the report your carrier is asking for.
- Review of your crisis and incident response plan, playbooks and processes
- One custom-built scenario for your industry and risk profile
- A 3-hour live, facilitated session
- Written after-action report
- Signed attestation with date, duration and participants
- Covered by the Carrier Acceptance Guarantee
Reduced pricing is available to registered charities, not-for-profits and non-governmental organizations. Raise it on the scoping call.
Annual Readiness Program
Your renewal comes back every year. So does this. Two exercises, continuous support between them, and one facilitator who knows your business.
- Two Carrier-Ready Tabletops (valued at $30,000 total)
- BONUS An Extended Exercise Record (valued at $8,000)
- One executive exercise and one operational exercise
- Unlimited report revisions as carrier requirements change
- Quarterly 30-minute readiness check-in
- Same named facilitator for the full term
- Priority scheduling, booked within 10 days
- Re-onboarding whenever a member of your leadership team changes
The second exercise, and everything around it, costs less than the first one did.
Regulated firms in financial services and healthcare, companies working through a SOC 2 or ISO 27001 audit, and anyone who has already had an incident, where the next person to read the report is a regulator or a claims reviewer rather than an underwriter.
Frequently Asked Questions
Will our carrier actually accept this?
That is what the Carrier Acceptance Guarantee is for. If your carrier, broker, or auditor says the report does not meet their requirement, we revise it until it does, at no cost and with no deadline.
Does this replace live drills or a full incident response program?
No. A tabletop tests decision-making, not systems. Technical drills and a maintained response plan remain essential. This is the piece that demonstrates your leadership team has actually worked through a scenario together.
Can this work alongside the plans we already have?
Yes, and it should. We build the scenario around your existing incident response and business continuity plans, so the exercise tests what you actually rely on rather than a generic template.
Who needs to be in the room?
Your CEO or Managing Partner, your CFO or COO, whoever owns communications, and your IT lead. Between six and twelve people works best. Fewer than five and the disagreements that make the exercise valuable do not surface.
Is our data safe during the exercise?
Exercise material stays private to your organization and is never used to train public AI models. You control what scenario details are shared and with whom.
At a large firm the velvet glove goes to the accounts ten times your size. You only get their generic exercise templates because you aren't their biggest client. We give you the full treatment, at a rate built for your size.
Get our 10+ years of experience for free
During our intro call, many teams realize that their current processes need attention. Since we've peeked inside 100+ firms' incident response processes, we're happy to share the most common pitfalls and provide some advice on how you can improve. On the house.