How it works

The first bad hour, rehearsed.

This is what your team does when the note appears: named people, real handoffs, real decisions, on a running clock. Verdus Cyber turns that hour into muscle memory, and into evidence.

From note to contained

What a rehearsed team does next.

The same ransom note from the console above: this is how a prepared team runs it, end to end, in four hours. An illustrative, composite run.

T+00:00
Event
Ransom note appears on every machine in finance
Production offline · LockBit 3.0 signature confirmed
T+00:14
ActionAdrian Park · SOC Lead
AD ringfenced · tier-0 isolated
Encryption halted at the domain boundary
T+00:32
MilestoneDana Mitchell · IR Lead
War room open · Sev-1 declared · all hands
5 responders online · controller monitoring
T+01:12
DecisionCEO · CISO · Legal · Decision cmte
Decline ransom · engage negotiator in parallel
OFAC clear · board approval logged in 8 minutes
T+02:18
ActionMaya Khan · Legal
NIS2 early warning (24h) filed with the CSIRT, 72h incident notification in preparation
Inside the 24-hour window · evidence pack attached
T+03:00
Milestone
Contained · clean restore from immutable backup
Finance services back online over the next 25 min
T+03:30
ActionTom Lambert · Comms
Customer statement issued · social + press desk
Ahead of any media query · one clean narrative
T+04:00
Milestone
Board briefed · evidence package captured
MTTD 14 min · MTTC 3h 00m · NIS2 on time
MTTD
14 min
in this illustrative run
MTTC
3h 00m
in this illustrative run
NIS2
On time
early warning inside 24h
Customers
Briefed
before press knew
Two seats, one exercise

You run it. They live it.

A facilitator drives the exercise from the controller seat; participants respond from theirs. Both views stay in sync.

Controller

You drive the pressure

Fire the next inject, hold one back, pause to coach, or drop a curveball mid-flight, then watch how the team responds.

  • Inject queue & timing control
  • Live team status & decisions
  • Pause, resume, add curveball
Participant

They face the crisis

The team works the incident from a realistic console (inbox, calls, news, chat), capturing each decision as evidence.

  • Real channels, real injects
  • Team chat & decision capture
  • Business impact updating live
Getting started

From kickoff to board-ready in four steps.

STEP 01

Scope

Pick an industry template and difficulty, or co-design a scenario around your real threat model and stakeholders.

STEP 02

Run

Your team enters the live console. Injects escalate, phones ring, and every decision is timestamped as it happens.

STEP 03

Debrief

Facilitators walk the timeline, surface decision points and score performance across eight competencies.

STEP 04

Report

Leave with a framework-mapped readiness report: prioritised findings and a remediation roadmap for the board.

The morning after

The room goes quiet. The evidence stays.
T+05:40STATUSContainment confirmed, production restart cleared.
T+05:52EVIDENCEEvery decision timestamped: who acted, when, on what information.
T+06:10DEBRIEFScored across eight competencies, mapped to NIST CSF, ISO 27001 and NIS2.

Run your own first bad hour.