A facilitated, discussion-based readiness exercise for leadership — your scenario, your obligations, one hour, no live systems at risk. The gaps get found in a room you chose, on a day you chose.
The two doors · the exercise · the turnReads with sound off
Most organisations rehearse neither. The exercise puts both on the table.
Reconnaissance that took weeks now takes hours. A scan maps your subsidiaries, finds the one mail server, and narrows — faster than any human red team ever did. The first question in the room is whether anyone would notice, and who they would tell.
The clock starts before you know it exists.
No malice — just trust. A customer spreadsheet pasted into an assistant to "just summarize this". A vendor-payment change drafted fluently and approved without expanding the details. The system worked exactly as designed; nobody decided anything.
Overtrust is not a character flaw. It is an unmanaged system.
A structured, discussion-based simulation for your leadership team: a senior-level scenario tailored to your sector and risk profile, with realistic simulated injects — a press inquiry, a flagged payment, a screenshot circulating — arriving while the discussion runs.
A formal, audit-ready record that the exercise took place: scenario, date, participants, scope. When an auditor or authority asks whether your continuity arrangements are exercised, this is the artifact that answers.
What the room discovered, made usable:
Every finding is mapped to the operative obligation. NIS2 § 6 nr. 3 does not ask whether you have a continuity plan — it asks whether it is exercised. The 24-hour / 72-hour / one-month incident chain is a named control in the Klarr evidence model. A readiness exercise produces exactly the artifacts those obligations are asking about.
The hour in the room is the cheapest way to discover, in rehearsal, which of your obligations would fail in production — each gap traced to the paragraph that makes it your problem.
Delivered as a Klarr service, scoped in a short call, run at your premises.
Every package is scoped to your sector in one short call, and the price is fixed before you commit. Every session is facilitated at your premises and ends with an audit-ready record that the exercise took place.
A first exercise, or the compliance requirement met with minimal overhead.
A scenario built on your actual threat landscape, not a template.
A roadmap out of the room, not just an hour in it.
Board-level and technical-level combinations, multi-session programmes and preparedness-document updates are scoped as custom engagements — ask in the call. Prices exclude VAT.
Request an exercise and we'll scope the scenario to your sector in one short call — package and exact price fixed before you commit.