Multi-person tabletop
Bring leaders, operators, and specialists together to practice coordination and expose cross-functional assumptions.
Plan a readiness sessionFind the gaps before a real event does.
Bring the plans, roles, dependencies, and decisions your team relies on. Alfred helps facilitate a realistic exercise, records what participants decide, and organizes a reviewed output with an owner and next action for each priority.
Ransomware response exercise
Shared files are unavailable. Suspicious sign-ins appear. Your team must decide what to contain, who to involve and how to communicate.
- Confirm the plans, roles, and assumptions to test
- Practice each role's decisions in a facilitated scenario
- Approve priorities, owners, and next actions
A plan is not the same as a practiced response
Policies can look complete until an incident forces people to interpret them. Start with the documents, roles, systems, and assumptions that matter. The exercise puts them under pressure so participants can see what works, what is unclear, and what must change next.
What the exercise produces
The work moves from confirmed inputs to a facilitated session and a participant-reviewed action record.
Prepare
Select the plans, policies, contracts, role maps, dependencies, and assumptions that matter. Mark authoritative sources and define the decisions to test.
Plan a readiness sessionIllustrative sample
Context
- Context
- Scenario
Exercise
A facilitator introduces a credible event sequence and role-specific questions. Participants interpret the facts, make decisions, and choose when to escalate.
Plan a readiness sessionIllustrative sample
Session
- Session
- Review
Improve
Participants review the timeline, decisions, gaps, and proposed actions. Each accepted priority receives a human owner and a next action.
Plan a readiness sessionIllustrative sample
Leave with a reviewed action record
- Incident response lead
- Propose an authoritative contact sequence.
- Legal and communications leads
- Clarify approval roles and record the handoff.
- Service owner
- Confirm the dependency and name a recovery verifier.
From source material to owned action
Four concrete stages turn existing plans into a facilitated exercise and a reviewed output.
Context
Choose the documents, systems, roles, dependencies, and open assumptions. Confirm which sources participants may rely on.
Scenario
Build a plausible event sequence around the chosen risk, objectives, dependencies, and decisions to test.
Session
Facilitate role-specific questions as events unfold. Record decisions, uncertainties, handoffs, and proposed actions without making decisions for participants.
Review
Give participants the organized timeline and observations to correct and approve. Record a human owner and next action for every accepted priority.
Readiness programs shaped around the risk
Use one focused exercise or connect related sessions into a recurring program. Scope and specialist involvement should match the subject.
Incident response
Explore detection, triage, containment, communication, recovery, and evidence handling in a tailored incident scenario.
Business continuity
Test critical activities, workarounds, dependencies, recovery priorities, and continuity assumptions.
Executive crisis
Practice leadership decisions, stakeholder communication, escalation, and governance with incomplete facts.
Policies, SOPs, training, and workplace playbooks
Use operational, ethics, and HR guidance to reveal ambiguity, ownership gaps, and training needs.
AI-use governance
Simulate approved use, sensitive data, oversight, escalation, and accountability. This is governance practice, not runtime AI defense.
Critical vendors, services, and contracts
Examine disruption, contractual duties, concentration risk, handoffs, and evidence for vendor reviews or insurance renewal discussions.
Recall and safety
Structure specialist-scoped exercises around recall, safety escalation, communication, traceability, and decision ownership.
Leave with a reviewed action record
The output shows what participants observed, who owns the issue, and the next action they accepted.
Ransomware response exercise
Shared files are unavailable. Suspicious sign-ins appear. Your team must decide what to contain, who to involve and how to communicate.
- Observation
- Initial escalation relies on an informal contact path.
- Owner
- Incident response lead
- Next action
- Propose an authoritative contact sequence.
- Observation
- External notification approval is unclear.
- Owner
- Legal and communications leads
- Next action
- Clarify approval roles and record the handoff.
- Observation
- A recovery assumption has no named verifier.
- Owner
- Service owner
- Next action
- Confirm the dependency and name a recovery verifier.
This is an illustrative example based on a fictional scenario. It is not a live session record, customer report, or statement of actual performance.
Choose the working format
Individual operational simulation
One participant explores role-specific questions, decisions, and handoffs before human review.
Plan a readiness sessionRecurring readiness program
Connect exercises across changing risks, teams, and documents. Reviewed outputs inform the next program decision.
Plan a readiness sessionPeople approve every conclusion and action.
Alfred can help tailor scenarios, adapt questions, and organize session records. Participants validate the inputs, facts, observations, owners, and next actions. Alfred does not certify readiness, approve controls, make binding decisions, or replace specialist review.
What plans or documents can shape an exercise?
Inputs can include policies, response and continuity plans, SOPs, contracts, role maps, training, and approved playbooks. The team identifies authoritative sources.
What does AI decide?
AI supports scenario design, prompts, and structured notes. People interpret the situation, choose actions, and approve plan changes.
How does this relate to our existing platforms?
Alfred adds a context and exercise layer. Existing systems remain the source of truth. Any integration needs separate scope and validation.
Is a simulation the same as an audit?
No. A simulation practices decisions in a constructed scenario. An audit tests evidence against criteria. Exercise observations are not audit conclusions.
Test the plan before the pressure is real
Bring the risk, the participants, and the plans you already use. We will help shape a focused exercise that ends with reviewed priorities, owners, and next actions.