Practice on the good days so you're ready for the bad days.

We built Breachday because we were tired of discovering our incident response flaws during actual incidents.

The Problem

Most security and engineering teams don't run tabletop exercises often enough. The reason is simple: they are painful to organize.

A facilitator spends 20 hours building a massive slide deck. During the exercise, communication happens across disjointed Zoom chats, Slack channels, and overlapping voices. Afterward, someone has to decipher chicken-scratch notes to figure out what decisions were actually made and write an After-Action Report.

Enter Breachday

We designed Breachday to solve this mechanical pain. By providing a structured, synchronized timeline for events and decisions, we free the facilitation team to focus on what matters: the human dynamics of incident response.

The Join Room Experience

Breachday works like a live room code experience for incident response. Participants go to a join link, enter a short code, choose a display name, and claim their role seat. No account creation, no install, and no onboarding friction for executives, legal, or non-technical stakeholders.

  • ✓Join from any phone, tablet, or laptop using a short room code
  • ✓Capture responses, votes, and post-exercise feedback by participant session
  • ✓Produce report-ready artifacts with clear role-based attribution

Grounded in real breaches and government playbooks

Hypothetical scenarios are easy to dismiss. Our scenario library is built from actual public breaches — the wire fraud incidents, ransomware events, identity provider lockouts, and insider data theft cases that have shaped modern incident response — plus the CISA Cybersecurity Tabletop Exercise Package (CTEP)-based templates published by the U.S. Cybersecurity & Infrastructure Security Agency.

Your team isn't running a thought experiment. They're rehearsing the exact patterns attackers and operational failures keep using — with prompts and decision points that the U.S. government recommends for sector-specific resilience.

Compliance evidence, not just exercises

Every Breachday session generates a structured after-action report — timeline, decisions, vote tallies, observations, affected assets, and processes exercised — that maps directly to the controls auditors care about:

  • →SOC 2 — incident response and availability controls (CC7.x)
  • →PCI DSS 4.0 — Requirement 12.10.1 incident response plan testing
  • →SEC Item 1.05 — demonstrate cyber incident response readiness for the 4-day disclosure rule
  • →ISO 22301 — Business Continuity Management exercise and review evidence

The exercise hour itself is your audit artifact. No screenshotting Slack threads. No pasting notes into Word.

A BC program — not just an exercise tool

Tabletops are the pointy end of a much larger program. Breachday Plus and Pro give you a place to run that program: an IT Asset Register with criticality, RTO, and RPO; a Business Impact Analysis that maps processes to systems, roles, and vendors; and Crisis Communication Plans for customers, employees, regulators, and the press. Every exercise links to the assets and processes it touches — so your reports show, with receipts, exactly what you've tested.

Our Core Principles

  • 1
    Realistic pressure Incidents are messy. Timed injects and incomplete information simulate the fog of war better than linear slide decks.
  • 2
    Low friction participation Executives and external counsel shouldn't need a tutorial to use the tool. Room codes and a simple UI make joining effortless.
  • 3
    Actionable outcomes If a tabletop doesn't result in concrete improvements to runbooks or architecture, it was wasted time. Our lessons learned tracker ensures follow-through.
  • 4
    Compliance-ready by default Every exercise produces an audit-grade artifact mapped to SOC 2, PCI DSS, SEC, and ISO controls — without a separate writing project.

Whether you're a startup running your first SOC 2 tabletop, a public company prepping for SEC disclosure readiness, or a Fortune 500 with a weekly red-team cadence, Breachday makes the process repeatable, defensible, and worth doing. Empathy for the on-call responder is at the heart of everything we build.