The briefing

Before the exercise starts, you see the Mission briefing. Read it with your team so everyone starts from the same facts.

What the briefing shows

Scenario panel. The scenario name, severity and category. ISO 27035 scenarios also show their difficulty. Many scenarios include an Organisation context section with more detail. Real World Attacks show a Case file with the incident, date and sector.

Threat actor panel. Who you are up against:

For cyber scenarios: the threat actor’s name, aliases, nation, motivation, targets and key MITRE ATT&CK techniques.
For crisis scenarios: the Adversary profile and its signature behaviours.
For third-party resilience scenarios: a Disruption note. There is no attacker. The exercise is about your firm’s resilience and regulatory response.
If you chose No Specific Threat Actor, the techniques emerge during the exercise.

Add attendees (optional)

Under Attendees (optional), record who is taking part.

Select + Add attendee.
Enter a Name and, if you like, a Role / title.
Repeat for each person. Select × to remove a row.

Attendee names and roles appear on the PDF report. Rows with no name are left out.

Rules of engagement

Every briefing explains the rules of engagement. You have limited people and limited time. Anything you do not act on now waits, and the incident does not.

On Pro and Enterprise, you also choose the Pressure on your team:

Standard: the team loses 3 to 4 people over the exercise.
Hard: the team loses 5 people. Expect a round with nobody available unless you escalate in time.

See Playing rounds for how people work in each round.

Start the exercise

Select Begin exercise. To pick something else, select Change selection.