Ransomware
Business disruption, recovery and communication decisions.
Cybersecurity Virtual Simulation Platform · Tabletop Exercises
The best incident response is one your team has already practiced.
Because the best response starts with simulation practice. Run virtual cyber tabletop exercises that test your Incident Response Plan with every team that would be in the room on the worst day.
Ransomware: finance file servers
- COCommunications · Press inbox
A reporter heard patient billing is down and wants comment by 6 PM.
- LGLegal · Ransom note
Note claims customer records were copied. Notification deadlines may now apply.
- EXExecutive leadership · CFO
Can Monday payroll still run if finance systems stay offline?
- TRTechnical responders · EDR alert
Mass file encryption detected on FIN-FS02. Spreading to two more hosts.
One tabletop exercise for every team:Technical respondersLegalCommunicationsOperationsExecutive leadership
Don’t just document your incident response. Practice it.
SIMTTX enables security, IT, legal, communications, and leadership teams to test and practice their Incident Response Plans through realistic cyber crisis simulations. Teams strengthen coordination, sharpen decision-making, and build the confidence to respond effectively if and when a real incident strikes.
Test your Incident Response Plan
Put your plans, procedures, and escalation paths to the test in realistic cyber crisis scenarios.
Practice as one team
Rehearse decisions and handoffs across security, IT, legal, communications, and leadership.
Identify gaps before a crisis
Find weaknesses in coordination, communication, and decision-making while there’s time to improve.
What’s in a name
SIMTTX stands for Simulation Tabletop Exercise.
A tabletop exercise (TTX) is a practice session where the people responsible for an incident walk through a realistic scenario together and decide what they would do. SIMTTX keeps that proven format and turns it into a virtual simulation that feels like the real thing.
Traditional tabletop exerciseSIMTTX tabletop exercise
PreparationWeeks of slides and scriptsReady-made scenarios you tailor in one sitting
During the exerciseOne facilitator reads the scenario aloud to the roomEach role receives its own injects, in the room or remote
DecisionsNotes on a whiteboardCaptured with reasoning and timestamps
ResultsA summary written days laterAn after-action report with scores and gaps
Follow-upGaps fade until next yearAction items tracked and retested
Why practice
Most teams rehearse once a year. Crises don’t keep a schedule.
The 2024 CrowdStrike outage and the Change Healthcare ransomware attack weren’t in anyone’s tabletop playbook. Annual exercises can’t keep up: skills fade between sessions, and the crisis that tests you is rarely the one you planned for.
SIMTTX makes practice a habit, so your teams rehearse often enough for the response to become second nature.
68%Once a year, as a tabletop exercise
15%Never test their crisis plan
5%Practice continuously
Source: poll of senior security and resilience practitioners at ASIS Europe 2026 (about 20 respondents), reported in MIT Sloan Management Review, October 2026.
Prepare the whole team to respond with confidence.
Bring technical responders, legal, communications, operations, and executive leadership into the same simulation practice, so everyone knows their role if and when a cyber crisis strikes.
Technical responders
Scope the attack, contain it, and keep evidence intact while the business asks for answers.
- Triage and scoping under time pressure
- Containment decisions and their trade-offs
- Evidence handling and handoff to forensics
● New inject+0 min
EDR: mass file encryption on FIN-FS02
From: Endpoint detection
2,140 files renamed with a .lckd extension in four minutes. Two additional hosts show the same process.
Your call: isolate the segment or keep watching to scope the spread?
How it works
How a SIMTTX tabletop exercise works.
A continuous cycle of practice. Every tabletop exercise feeds the next, so your plan and your people get sharper each time.
Choose a scenario
Pick a tabletop scenario from the library by threat, industry, difficulty, and the teams you want in the room.
Make it yours
Add your company, critical systems, and tools so every inject reads like your own environment.
Invite the team
Assign roles and send invites. Participants join from a link, with no account or training needed.
Run it live
Release injects in real time. Each role sees what it would really receive, and every decision is captured.
Review the report
Get an after-action report with the timeline, decisions, scores, and gaps, ready for leadership.
Fix and retest
Turn gaps into owned action items, then run the next tabletop exercise to confirm the fixes hold.
Back to the start
Inside a SIMTTX tabletop exercise
Built for the way real incidents unfold.
Every role sees its own crisis
Teams get only what they would really receive. At the same moment, Legal reads the regulator’s email while the SOC works the endpoint alert.
Facilitator console
Release injects on a timer or by hand. Pause, skip ahead, or drop in an unplanned twist.
Decisions that change the story
Teams answer with a choice and their reasoning. The scenario follows the path their decisions create.
After-action report
Timeline, decision log, scores, and recommendations, drafted automatically and approved by your facilitator.
Remediation tracking
Every gap becomes an action item with an owner and a due date, so lessons turn into fixes.
Evaluation
Know how ready you are, and prove it.
Each tabletop exercise is scored across the areas that decide how an incident goes. Every score is backed by observer notes and timestamps, then confirmed by your facilitator.
The result is evidence your board, auditors, and cyber insurers can review, and a clear view of what to fix before the next exercise.
Readiness scoresExample report · Ransomware exercise
- Detection and escalationEffective
- Incident commandPartial
- Containment and recoveryEffective
- Legal and regulatoryNot demonstrated
- CommunicationsExemplary
- DocumentationPartial
Top gapNotification deadlines weren’t identified until 2 hours into the incident. Action item assigned to Legal.
Initial cyber scenarios.
Ready-to-run cyber tabletop exercise scenarios. Each one puts a different part of your response plan under pressure.
Data breach
Disclosure, investigation, legal and customer response.
Third-party compromise
Vendor dependency, business impact and coordinated escalation.
About SIMTTX
A simple belief: teams improve through practice.
SIMTTX is being developed around the idea that response resilience comes from coordinated simulation practice, not static documentation alone.
Our mission
Help organizations turn cyber crisis plans into practiced organizational readiness. Make realistic, cross-functional exercises easier to create, run and learn from.
Cyber crisis response is a team sport. SIMTTX is where the team practices.
Partners
Help more organizations practice resilience.
Bring SIMTTX simulations to the clients you already advise, and give their teams a place to rehearse before it counts.
Managed security providers
Add recurring exercises to the services your clients already rely on.
Cyber consultants and advisors
Run realistic simulations as part of readiness assessments and planning work.
Insurers and brokers
Help policyholders show they have practiced their Incident Response Plan.
Request a demo.
See a SIMTTX tabletop exercise built around your own Incident Response Plan and the people who carry it out.
- A walkthrough of a live tabletop exercise from every team’s seat
- A scenario matched to your industry and risks
- Time to talk through your current response plan
Request received
Thanks, . The SIMTTX team will reach out at to schedule your demo.
Send your request by email
Send your details to our team and we’ll reply to schedule your demo.
demo@simttx.com