For consultants

You run the practice.
We run the room.

Every client on your book owes an annual incident response tabletop, on a different date, and each one costs you a week of building material and a day of being the person taking notes. ControlDrill does the run and writes the record. The relationship, the judgement, and the fee stay yours.

Run one for a client, $199 See what the client gets

The work it removes

Stop rebuilding the deck.

The material is generated from the client's own intake and, if they upload it, their own incident response plan. The injects name their hosts, their recovery objectives and their contractual clocks, so the exercise is theirs rather than a scenario you adapted from the last engagement.

During the run, answers are typed and attributed. Nobody reconstructs the session afterwards from memory, which is the part that usually eats your evening and produces the weakest section of the write-up.

First conversation

What you will be asked.

We already run tabletops: Keep running them. Your judgement is the part clients pay for. Use ControlDrill for the room and the record so you are not also the scribe.
Will the auditor accept it?: Auditors accept evidence of what a team actually did. The packet is attendance, timeline, decisions and gaps. We never claim a control is passed, so there is nothing for an auditor to argue with.
Is my client's plan safe?: Tailoring runs on the same platform that serves the app, with no third-party AI provider in the path. Plans are never used to train models and are deleted on request.
What does it cost me?: $199 per exercise, the same price anyone pays. Your advisory fee is separate and stays yours.

Commercials

There is nothing to sign.

There is no partner programme, no reseller tier and no volume discount today. You buy an exercise at $199 the same way anyone does, currently a launch price against a standing $299, and you bill your client however you already bill them.

If you are running these across a real book and the commercials matter, say so and we will have that conversation properly rather than inventing a tier on a web page.

Run one for a client Talk about volume

Before you recommend it

What you should not tell a client.

That it satisfies SOC 2, certifies anything, or replaces a technical disaster-recovery or backup-restoration test. It does none of those, and we would rather you hear that from us than from your client's auditor.