Your team’s incident response readiness,
tested and documented in under an hour.
TTXLab gives security, resilience, and governance teams structured simulations with adaptive facilitation and audit-ready reports — no live facilitator required.
No demo call required. See a real exercise report in seconds.
IR Exercise — Ransomware Scenario
Acme Corp · Started 2:47 PM
How It Works
From self-serve setup to audit-ready report
in one guided workflow.
Set up your workspace
Sign in, name your workspace, and invite your team. You are ready to run exercises in minutes.
Configure the exercise
Choose an exercise type, set your scenario parameters, and align participant roles before launch.
Facilitate live
Run a guided AI-facilitated session with adaptive injects, role-aware prompts, and transcript capture.
Share the report
Export structured findings, scores, and remediation direction your leadership and audit teams can review.
Audit-Ready Reports
Reports leadership, responders,
and auditors can all use.
Every completed run ends in one structured artifact instead of scattered notes, screenshots, and ad hoc follow-up.
IR Exercise — Ransomware Scenario
Communication
85%
Decision Making
72%
Escalation
68%
Procedures
88%
Complete Transcript
Timestamped record of facilitator prompts, participant responses, and decision points from the full run.
Scored Performance
Track communication, escalation, decision quality, and procedural execution in one summary view.
Sourced Recommendations
Each recommendation is tied to recognized frameworks instead of unsourced generic AI guidance.
Auditor-Ready PDF
Export a structured artifact that leadership, compliance, and audit stakeholders can review quickly.
Exercise Library
Eight exercise types.
One repeatable operating model.
Cover incident response, resilience, and communications drills with structure that lets teams compare runs over time instead of improvising a different process for each exercise.
IR Incident Response
Coordinate detection, containment, eradication, and recovery actions.
Default Roles
What Gets Tested
- Detection and triage speed
- Cross-team escalation
- Containment decision-making
- Evidence preservation
- Post-incident review
Example Scenario
A SOC analyst flags anomalous outbound traffic from a payment processing server at 2 AM. The team must coordinate containment while preserving forensic evidence.
Explore by exercise type
How the AI Works
Realistic exercises. Defensible reports.
A fast facilitator keeps the exercise moving. A deliberate adjudicator keeps the final report defensible. Two specialized models working together so your team gets practice that feels real and documentation that holds up.
The Facilitator
Drives the live run by introducing injects, adapting scenario progression, and prompting the right role.
- ✓ Realistic, adaptive exercises
- ✓ Dynamic scenario adaptation
- ✓ Role-aware question targeting
- ✓ Realistic incident inject generation
The Adjudicator
Scores responses, applies guardrails, and generates reporting your governance stakeholders can rely on.
- ✓ Reports your auditors will accept
- ✓ NIST / SANS / ISO citation support
- ✓ Gap analysis and remediation direction
- ✓ Content and tone guardrails
CISA Template Library
Government-backed scenarios,
AI-powered execution.
Pricing
Simple pricing that scales with your program.
Start with a single exercise or lock in a recurring plan. Every tier includes full reporting and the complete exercise library.
Pay Per Exercise
$299
one-time purchase
$299/exercise
Best for one-off validation drills and first-time pilots.
- ✓ 1 exercise credit
- ✓ Any exercise type
- ✓ Full report export
- ✓ 90-day artifact access
Starter Annual
$999
per year · 4 exercises/year
$250/exercise — save $49 each
For smaller teams building baseline readiness without monthly overhead.
- ✓ 4 exercise credits/year
- ✓ CISA template library
- ✓ Role-based facilitation
Professional
$199
per month · 12 exercises/year
~$199/exercise — save $100 each
For teams building recurring muscle memory through monthly exercises.
- ✓ 12 exercise credits/year
- ✓ All exercise types + CISA library
- ✓ Exercise history and dashboard metrics
- ✓ Scheduling and reminders
- ✓ Priority support queue
Enterprise
Custom
contract pricing
For multi-team organizations with centralized readiness governance.
- ✓ Everything in Professional
- ✓ SSO / SAML enablement
- ✓ Custom report branding
- ✓ Cross-team benchmarking
- ✓ Unlimited participants
- ✓ SLA-backed uptime (see Trust Center)
- ✓ Dedicated customer success manager
- ✓ Data residency options
- ✓ Advanced audit logs
- ✓ Custom integrations (SIEM, GRC)
Typically responds within 1 business day
FAQ
Frequently asked questions
Stop improvising.
Start proving readiness.
Every exercise builds evidence your auditors, board, and regulators can review. Set up your workspace in minutes and run your first exercise today. Or browse the starter kit, review the Trust Center, or check recent changes in the changelog.