Rehearse the incident before it happens.
With the people who will be on the call.
ThreatRehearse runs branching incident response and disaster recovery exercises from ThreatGovern™. Built on NIST SP 800-84 and CISA Tabletop Exercise Packages, with the Vijilan SOC in the room.
Three ways in.
One standard of exercise.
MSP and MSSP partners
Exercise your own team, quarterly.
Included with your Vijilan partnership. The scenarios are built for the way MSPs get attacked: RMM compromise, PSA compromise, technician account compromise, poisoned supply chain updates and several customer incidents at once.
Your customers
Deliver exercises to your clients from the partner portal.
Co-branded situation manual, after action report and attestation. Facilitate it yourself or request a ThreatGovern facilitator.
We never compete with our partners for their clients.
Mid-market and enterprise
Facilitated by ThreatGovern, sized to your organization.
Executive and technical tracks, run with the people who would actually be on the call.
Ten steps.
About ten minutes to set up.
- Choose the audience.
- Size the organization.
- Tick the frameworks that apply.
- Pick a scenario.
- Assign CSIRT roles and invite people.
- Name the out-of-band channel and the one voice for external communications.
- Set the date and the cadence.
- Generate the kit.
- Run it in facilitator mode.
- Close it with a hotwash, an after action report, an improvement plan and an attestation.
Sized to your organization.
Run on a rhythm.
| Tier | Size | Session length | Frequency |
|---|---|---|---|
| Small | Under 100 users or under 250 assets | 60 to 90 minutes | Annual minimum, plus a refresh after major change |
| Mid-market | 100 to 1,000 users or 250 to 2,500 assets | 2 to 3 hours | Twice a year |
| Enterprise | Over 1,000 users or over 2,500 assets | Half day | Twice a year minimum, quarterly where a regulator or insurer expects it |
| MSP and MSSP teams | Your own technicians and leadership | Sized to your team | Quarterly |
Every organization also runs an exercise after a real incident or a change to its incident response plan.
Every inject ends in a decision.
Every decision changes the story.
ThreatRehearse exercises branch. The choice your team makes changes what happens next. The after action report shows the path you took and the paths you did not.
Every scenario is tailored to your actual systems. Every scenario includes the moment the Vijilan SOC detects, escalates and asks your team for a decision.
Core
Dead Drop
Your data turns up somewhere it should never be.
The Signature
A signing request that looks exactly like the real thing.
Fatigue
One more push notification, and someone finally taps Approve.
Ghost Session
Someone is signed in as your user. Your user is asleep.
Exit Interview
A departing employee still has the keys.
Collateral
A breach at someone you trust becomes your problem.
Left Behind
A laptop is gone, and so is what was on it.
Gridlock
Every system is up. None of them is usable.
Familiar Voice
The CFO calls with an urgent request. It is not the CFO.
The Clock
The countdown starts the moment you find out.
Front Page
A reporter calls before your own team does.
Follow the Money
A changed bank detail, and a payment already sent.
MSP and MSSP
One Push
Your RMM sends one command to every client at once.
Ticket Stub
Your PSA becomes a map of every customer you serve.
Master Key
The technician account that opens everything is in the wrong hands.
Trusted Update
The update came from a vendor you trust. That is the problem.
Triple Alarm
Three customers call in the same hour.
Industry
Code Blue
Clinical systems go dark in the middle of a shift.
Wire Cut
Payments stop on the day the money has to move.
Line Down
The production line stops, and every hour has a cost.
Snow Day
Everyone has to work remotely on the day remote access fails.
Open Vault
Records that should be locked are suddenly open.
Disaster recovery
High Water
The water reaches the server room.
Swarm
Traffic from everywhere, all at once, aimed at you.
Dark Office
The building loses power. The business still has to run.
Everyone who would be on the call.
Rehearsing their part.
- Incident commander
- Executive sponsor
- Technical lead
- Vijilan SOC
- Communications lead
- Legal and privacy
- HR
- Business unit liaison
- IT operations
- External parties
In a small organization one person holds several roles. The exercise makes that visible.
Many of them expect you to exercise.
Here is where it is written.
| Framework | What it asks for | In plain language |
|---|---|---|
| NIST CSF 2.0ID.IM-02 | Improvements identified from security tests and exercises. | Exercises are an expected input to improving your program. |
| NIST SP 800-53IR-3, CP-4 | Test the incident response capability and the contingency plan. | The federal control catalog names testing as its own control. |
| NIST SP 800-171 / CMMC Level 23.6.3 / IR.L2-3.6.3 | Test the organizational incident response capability. | Assessors look for evidence that the test happened. |
| PCI DSS 4.0.112.10.2 | Review and test the incident response plan at least every 12 months. | An annual test is the floor, not the goal. |
| HIPAA Security Rule164.308(a)(7)(ii)(D) | Procedures for periodic testing and revision of contingency plans. | Testing is how you show the plan would work under pressure. |
| SOC 2CC7.4, CC7.5 | Respond to identified incidents and recover from them through a defined program. | Auditors often ask how you know the program works. |
| ISO/IEC 27001:2022A.5.24 to A.5.27, A.5.30 | Plan, assess, respond to and learn from incidents, and keep ICT ready for continuity. | Learning from incidents is a control in its own right. |
| CIS Controls v817.7 | Conduct routine incident response exercises, at least annually. | One of the clearest exercise requirements in any framework. |
| NY DFS Part 500500.16 | Incident response and continuity plans, tested at least annually. | Applies to entities regulated by New York DFS. |
| GLBA Safeguards Rule314.4(h) | A written incident response plan. | Exercising the plan is how you know it is more than paper. |
| FFIECIT Examination Handbook | Incident response and business continuity planning that is tested. | Examiners expect financial institutions to show testing. |
| DFARS 252.204-701272 hour reporting | Report cyber incidents to the Department of Defense within 72 hours. | Rehearse the reporting path before the clock is running. |
| SEC Regulation S-K and Form 8-KS-K Item 106, 8-K Item 1.05 | Describe cybersecurity risk management and disclose material incidents. | For registrants. The materiality decision is worth rehearsing. |
| EU DORADigital operational resilience | Test ICT response and recovery plans. | Relevant where you have EU financial sector exposure. |
| EU NIS2Incident handling and continuity | Incident handling, business continuity and staged incident reporting. | Relevant where you have EU exposure. |
| Cyber insurance underwritingUnderwriting questions | Evidence of a recent incident response exercise. | Underwriters increasingly ask when you last ran one. |
Citations as of October 2026. Requirements change and apply differently by organization. Confirm what applies to you with your auditor, regulator or insurer.
A kit before.
A record after.
Situation manual
The scenario, the ground rules and the roles, written for your systems.
Facilitator guide
Everything the facilitator needs to run the session and keep it moving.
Participant pre-read
What each person needs to know before they walk in.
Evaluation guide
What good looks like, so the debrief measures something real.
After action report and improvement plan
The path your team took, the paths it did not, and who fixes what.
Attestation of completion
A record that the exercise happened, with the date and the people in the room.
The attestation states that your organization completed a discussion based incident response exercise consistent with NIST SP 800-84 and CISA CTEP guidance.
It records that the exercise took place. It does not certify compliance with any framework or regulation.
Put your team in the room.
Before it is real.
Partners start an exercise from the portal. Everyone else, tell us about your organization and the ThreatGovern team will shape the first exercise with you.