Turn every tabletop into a report teams can actually use.
TTXLab packages the transcript, scored performance, findings, and follow-up actions into one structured output so leadership, responders, and auditors work from the same artifact.
Audit-Ready Reports
One report for leadership, responders, and auditors.
Every completed run ends with scores, transcript context, findings, and action items in one artifact instead of scattered notes and screenshots.
IR Exercise — Ransomware Scenario
Acme Corp · Feb 5, 2026 · 6 participants
Completed
78%
Communication
85%
Decision Making
72%
Escalation
68%
Procedures
88%
AI
AI FacilitatorFACILITATOR2:47 PM
INJECT: Your SOC has detected unusual outbound traffic from the payment processing server.
SM
Sarah MitchellINCIDENT COMMANDER2:49 PM
First priority is containment. Isolate the payment server immediately. Pulling in Legal and Comms now.
AI
AI FacilitatorFACILITATOR2:49 PM
Good call on containment. James, as Comms Lead, what channels are you preparing?
JR
James RiveraCOMMS LEAD2:51 PM
Drafting internal holding statement now. Will have external comms ready within 30 minutes.
Improve escalation timing for legal notification
NIST SP 800-61
Legal was notified 12 minutes after containment. Target notification within 5 minutes of confirmed data exposure.
Establish pre-drafted holding statements
SANS IR
Communications team did not have pre-approved templates available. Pre-draft statements for top 3 scenario types.
Formalize evidence preservation checklist
ISO 27035
No explicit evidence preservation step was triggered. Add forensic hold checklist to incident playbook.
Complete transcript
Timestamped record of facilitator prompts, participant responses, and decision points from the full run.
Scored performance
Track all five scoring dimensions — communication, decision quality, role adherence, escalation, and procedural compliance — in one summary view.
Sourced recommendations
Each recommendation is tied to recognized frameworks instead of unsourced generic AI guidance.
Auditor-ready PDF
Export a structured artifact that leadership, compliance, and audit stakeholders can review quickly.
One report, different readers
Each output is structured so every stakeholder can move from the same exercise into their next action.
01
Leadership
See performance trends, executive decisions, unresolved risks, and next actions without parsing the full transcript.
02
Responders
Review facilitator injects, participant actions, decisions, and moments where coordination slowed down.
03
Compliance and audit
Export a structured artifact with sourced recommendations for follow-up evidence packages.
What ships at the end of a run
Instead of piecing together chat logs and screenshots, your team gets one durable output package.
Score overview across all five dimensions — communication, decision quality, role adherence, escalation, and procedural compliance.
Timestamped transcript for reconstructing how the team handled the scenario.
Framework-mapped recommendations tied to recognized standards rather than generic summaries.
A PDF artifact that can move into after-action reviews, leadership briefings, and remediation tracking.
