Run a credible incident response exercise without hiring anyone.
Exercise tooling with evidence output. Drillroom runs the session from one screen, logs what your team decided and when, and produces a dated record you review before it goes anywhere. It is structured around what auditors look for. Whether yours accepts it is their judgement.
The check is free, takes four minutes and gives you the result without an email address.
If any of this is familiar
You are the person this landed on.
The surveillance visit is in the calendar. The exercise evidence is a folder with last year's write-up in it, and last year's write-up was written from memory a week afterwards.
You own security because nobody else does. There is no security team to hand the exercise to.
An hour of four or five people's time has to be justified to the people whose hour it is, and to whoever signs off their week.
And the part you actually think about is leading a session in front of colleagues, running something you have never run before.
What the licence includes
Five things, for a year.
- Organiser pack
- The invite text, pre-brief email, role sheet against your named colleagues, timed agenda and a note for your exec sponsor. Editable, then sent from your own inbox.
- Facilitated session
- Sixty minutes, run from one screen, in a room or shared on a video call. The injects arrive on a timeline and you log what was said as it happens.
- Evidence pack
- A dated PDF of attendance, the timeline, every logged entry with its time, the findings and the remediation actions with owners. You review and correct it before it exports.
- Quarterly scenarios
- New scenarios added four times a year through your licence period, so the second exercise is not the first one again.
- Micro-drills
- A fifteen minute single-inject run that appends a dated addendum to your current pack. It does not replace the pack and it does not reset its date.
Before you pay for anything
There is a good free option. Read this first.
The NCSC publishes Exercise in a Box. It is free, it is well made, and the scenarios in it are sound. If you have not looked at it, look at it before you look at this. A downloaded template and a colleague taking notes is also a real option, and plenty of organisations evidence an exercise that way.
What Drillroom does is structurally different, in four places. Not better questions. The same questions, with the assembly and the record done for you.
- 01The session gets into a diary. The organiser pack names your colleagues, gives them roles and explains to each of them why an hour of their week is being spent. Most exercises fail here, before anyone runs anything.
- 02The record writes itself as you go. Entries are timestamped when you log them, so nobody has to be the scribe and nothing gets reconstructed a week later.
- 03The output is formatted for the person reading it, with control references in the margin and a plain statement of what the document is and is not.
- 04It remembers. Last year's findings appear in this year's exercise, and this year's pack reports what closed and what did not. A free public tool cannot do that, because it does not know who you are.
If you have the time and the confidence to assemble it yourself, the free route works and you should take it. What is being sold here is the assembly and the record, not the questions.
Who built it
Built by someone who sits on the reviewing side of audits.
Matt is CTO at a UK regulated payments company, where he owns information security and technology risk. He has run live incident processes, presented exercise evidence to assessors, and been the person deciding whether somebody else's evidence was good enough.
Drillroom is the tool he wanted when he had to do this without a team. It is built in evenings, by one person, and the roadmap is honest about that.
Price
£499 a year, everything included
£499 is the whole amount charged. One operator account, unlimited exercises and micro-drills for twelve months. There is no larger tier, nothing is metered, and there is nobody to talk to before you buy.
Four minutes, no email address needed for the result.