Resources

Scenario library

Explore the IncidentRoom scenario library. Every exercise is built from real, publicly documented incidents, retold as original patterns with fully synthetic data. Run them solo or as a whole team.

Design principle

No AI on the live play path

Fixed before anyone plays. No AI in the room — the same decisions produce the same score, every time, and every scored decision is anchored to a published standard. Deterministic, defensible, documented.

Scenarios

Free · no credit neededStart here if this is your first exercise.

training

Incident Commander Trial: Lead the Room

Play the tutorial as many times as you like. No credits, no commitment.

Runs solo, or as a team of up to 4 seats

About 15 minutes.

What it exercises

Respond

Anchored to

NIST SP 800-61
NIST SP 800-53
CIS Controls

identity_compromise

Active Directory Compromise: The Crown Jewels

Runs solo, or as a team of up to 7 seats

About 105 minutes.

What it exercises

Respond
Recover

Anchored to

MITRE ATT&CK
NIST SP 800-61
NIST SP 800-53
CIS Controls

denial_of_service

DDoS Attack: Internet Under Siege

Runs solo, or as a team of up to 7 seats

About 100 minutes.

What it exercises

Respond
Govern

Anchored to

MITRE ATT&CK
NIST SP 800-61
NIST SP 800-53
CIS Controls

ransomware

Enterprise Ransomware: The Clock Is Running

Runs solo, or as a team of up to 8 seats

About 110 minutes.

What it exercises

Respond
Govern
Recover

Anchored to

MITRE ATT&CK
NIST SP 800-61
NIST SP 800-53
CIS Controls

executive_crisis

Executive Crisis: Decisions Under Pressure - Academic Edition

Runs solo, or as a team of up to 9 seats

About 120 minutes.

What it exercises

Govern
Recover

Anchored to

MITRE ATT&CK
NIST SP 800-61
NIST SP 800-53
CIS Controls

executive_crisis_corporate

Executive Crisis: Decisions Under Pressure — Corporate Edition

Runs solo, or as a team of up to 9 seats

About 120 minutes.

What it exercises

Govern
Recover

Anchored to

MITRE ATT&CK
NIST SP 800-61
NIST SP 800-53
CIS Controls

insider_threat

Insider Threat: Trusted Access Abused

Runs solo, or as a team of up to 7 seats

About 100 minutes.

What it exercises

Govern
Respond

Anchored to

MITRE ATT&CK
NIST SP 800-61
NIST SP 800-53
CIS Controls

identity_compromise

Microsoft 365: Privileged Account Compromise

Runs solo, or as a team of up to 7 seats

About 90 minutes.

What it exercises

Respond
Govern
Recover

Anchored to

MITRE ATT&CK
NIST SP 800-61
NIST SP 800-53
CIS Controls

zero-day vulnerability

Zero-Day: Race Against the Unknown

Runs solo, or as a team of up to 8 seats

About 100 minutes.

What it exercises

Respond

Anchored to

MITRE ATT&CK
NIST SP 800-61
NIST SP 800-53
CIS Controls

Need a scenario built around your own organization? See custom exercises.