INCIDENT RESPONSE TRAINING | TABLETOP EXERCISES
Incident response training for
the decisions that matter
Your incident response plan may look complete. But does your team know what to do when the facts change and the pressure rises?
Talon Peak, Aetos's interactive crisis simulation experience, helps executives, security teams, privacy leaders, and other decision-makers rehearse realistic incidents, test their coordination, and identify gaps before a real crisis.
Facilitated exercises from $3,500 | Standard sessions: 90-120 minutes | Executive and board options available
The Plan Isn't the Same as the Response.
An incident response policy may name roles, define escalation paths, and describe communication procedures. The real test is whether people can follow that plan when information is incomplete and decisions cannot wait.
Who Makes the Call?
A serious incident is suspected, but no one is sure who can declare it, escalate it, or authorize the next step.
Who Tells the Customer?
Security, leadership, and customer-facing teams have different information. The communication clock keeps moving.
What Happens When the Facts Change?
New evidence challenges the initial assessment. Your team has to reconsider priorities without losing control of the response.
Can You Show What You Did?
The incident may be contained, but decisions, approvals, handoffs, and supporting records still need to be reconstructed.
Practice the Decisions, Not Just the Checklist.
Incident response training should test how your organization actually operates. Talon Peak brings participants into an evolving scenario where decisions have consequences.
Escalation and Accountability
Who recognizes the incident, who takes ownership, who is informed, and when leadership becomes involved?
Cross-Functional Coordination
How do security, privacy, operations, communications, and leadership coordinate when each group sees only part of the picture?
Customer and Stakeholder Communication
What can your team communicate, who approves the message, and how do you manage uncertainty without overclaiming?
Governance and Follow-Through
Are decisions documented? Do participants recognize unresolved risks? Can the organization assign and track improvements afterward?
A Realistic Incident. Decisions Under Pressure.
Talon Peak is a facilitated tabletop exercise, not a lecture or a technical certification course. Participants work through changing facts, competing priorities, and the consequences of their choices.
Join
Bring together the people who would make or approve important decisions during a real incident.
Decide
Work through a realistic scenario as new information, competing demands, and difficult trade-offs emerge.
See Outcomes
Explore how decisions affect risk, customers, operations, and other stakeholders.
Debrief
Identify what worked, where coordination broke down, and which improvements deserve attention.
Incident Response Is a Team Sport.
Technical response matters. So do the business, governance, and communication decisions surrounding it. An effective exercise brings the relevant decision-makers together.
Security and Technology
Test incident escalation, technical handoffs, and communication with business leadership.
Privacy and Compliance
Practice information gathering, risk escalation, and coordination with appropriate advisers.
Executives and Operations
Rehearse decisions affecting customers, operations, business continuity, and organizational priorities.
Communications and Customer Teams
Test approvals, internal updates, external messaging, and stakeholder coordination.
Leave With More Than a Completed Exercise.
The purpose is not to prove that everyone made the right decision. It's to learn how the organization responds and identify what should improve.
Observed Decision Gaps
Identify areas where roles, escalation paths, communication, or coordination need attention.
Facilitated Debrief
Discuss important choices, unexpected challenges, and practical lessons with the participating team.
Results Report
Receive a documented account of exercise outcomes and findings to inform follow-up improvements.
The format and depth of reporting depend on the exercise selected and agreed scope.
Incident Response Exercises Built Around Your Objectives.
Start with a facilitated scenario, bring your leadership team into a more detailed exercise, or commission a simulation tailored to your organization.
Facilitated Simulation
A ready-made Talon Peak scenario with professional facilitation and a standard results report.
90-120 minutes
Discuss a Standard SessionEnhanced Simulation
A more in-depth facilitated exercise with additional briefing and discussion for executives, directors, or risk committees.
2-3 hours or half-day
Discuss an Executive SessionOrganization-Specific Exercise
A scenario designed around your business, industry, technology, and risk environment, with an agreed scope.
Format and duration scoped together
Discuss a Custom ExerciseTalon Peak is also included as a custom exercise within the $6,000 Aetos Readiness Sprint, using discovery and preparation completed during that engagement. Explore Talon Peak for more details.
Test the Response Before You Need It.
A Written Plan Tells You What Should Happen.
Incident response documentation establishes expected processes, responsibilities, escalation paths, and communications.
But documentation alone cannot show how your team will make decisions together under pressure.
A Tabletop Shows You How People Respond.
A facilitated simulation puts your team into realistic situations that require actual choices.
It helps you identify uncertainty, test coordination, and turn lessons into improvements before a live incident.
Find the Gaps in a Practice Room, Not During a Real Incident.
Your team will not have perfect information when something goes wrong. Give your decision-makers a chance to practice escalation, coordination, and communication before it counts.
Tell us about your team and what you'd like to test. We'll help you choose a practical exercise format.
30-minute strategy fit call. No obligation to engage.
Incident Response Training FAQs
What is an incident response tabletop exercise?
An incident response tabletop exercise is a structured, discussion-based simulation that lets participants practice their response to a realistic incident. It helps test decisions, responsibilities, escalation, and coordination without creating a real crisis.
Is this technical cybersecurity incident response training?
No. Talon Peak focuses on organizational decision-making, governance, communication, and coordination. It is not hands-on training in malware analysis, digital forensics, or technical incident containment. Technical response personnel can participate alongside leadership.
How long does a session take?
Standard facilitated simulations typically run 90-120 minutes. Enhanced executive and board sessions can run 2-3 hours or a half-day. Custom exercise duration depends on the agreed scope.
Who should attend?
Bring the people who would make or approve decisions during an actual incident. Depending on the scenario, that may include security, technology, privacy, compliance, operations, communications, and executive leadership. Board-focused formats are also available.
Can we test our own incident response plan?
Yes. A custom exercise can draw on your existing plans, processes, systems, and organizational risks. We'll discuss the materials needed and agree on the appropriate exercise scope before proceeding.
Can a tabletop help with SOC 2 or ISO 27001 readiness?
A documented tabletop exercise can help demonstrate that your organization practices incident response and evaluates its processes. Whether the exercise satisfies a specific audit or certification requirement depends on the applicable criteria, scope, and independent reviewer.
Does our company need a completed incident response plan?
Not necessarily. A tabletop can help identify responsibilities and processes that are unclear or missing. If your goal is to validate an existing plan against your actual operations, having that plan available is useful.
What is included in the price?
The standard $3,500 session includes a ready-made scenario, professional facilitation, and a standard results report. Enhanced and custom exercises are scoped according to their additional preparation, facilitation, and reporting requirements.
Can we start with a standard simulation?
Yes. A standard facilitated exercise is a practical starting point for teams that want to experience a realistic scenario before deciding whether they need more tailored testing.
Plan Your
Talon Peak
Simulation
Tell us a little about your team, and we'll help you choose the right exercise.
