Skip to content
Buy an exerciseBuy
T-00:00Before the drill

Test your incident
response plan.
Keep the evidence.

Your compliance platform records that you tested your incident response plan. It does not run the test. ControlDrill does, on your systems and your plan, and hands back the record.

Buy an exercise See how it works

$199 flat.Launch price, normally $299

T+00:00Inject 01

The clock starts.

A generic tabletop talks about "a server" and "a vendor". Yours names the host, the recovery objective, and the contractual clock you are actually on.

02:14 Inject 04 Illustrative, fictional org

At 02:14 your EDR flags encryption on prod-db-01 in us-east-1. Your Northwind MSA requires notification within 24h of confirmed exposure. Legal is asleep. Priya is on call.

Go.

Tailored from your IR plan v4. Cites prod-db-01, 4h RTO, Northwind MSA.
T+18:40Decisions

Your team decides,
under a timer.

Every call is attributed to a person and stamped with the time it was made. Nobody reconstructs it afterwards from memory, which is the part that makes a write-up worth nothing.

AI assists. It never makes the call for you. If the model is unavailable mid-exercise, the drill continues on the prepared material.

T+90:00The packet

What you hand
your auditor.

The exercise ends and the record is already written. This is the artifact, not a slide deck someone assembles the following week.

Date and duration
When it ran and how long it took.
Participants
Who was in the room, and what each of them decided.
Scenario
The injects as delivered, in order, with timings.
Gaps found
What the exercise surfaced, stated plainly.
Citations
The controls the exercise speaks to, as context for your auditor.

It records what happened, in enough detail that your auditor can weigh it.

Read a sample packet
T+90:01Scope

Where a tabletop
stops.

A tabletop proves your team can make and record decisions against a realistic incident. Proving your recovery works is a different exercise: restoring from backup and failing over a region are things you have to actually do. We say so here because your auditor will.

  • Security leads

    SOC 2 or ISO 27001 in progress. Run a real exercise with evidence, not a meeting invite and a vague write-up.

  • vCISOs and MSPs

    Client tabletops without building material or booking a facilitator each time.

  • Engineering leaders

    Find response gaps while it is cheap, before anyone is paging you for real.

T+90:02Next

Run one.

Tailored scenario, live facilitation, and the evidence packet for $199. Buy and schedule it yourself.

Buy an exercise Browse scenarios

Your IR plan is never sent to an outside AI vendor.