Research behind the rehearsal

A real practice problem.
A workflow you can test.

People already have incident documents. The harder job is often running the room, making decisions together, and turning what happened into useful follow-up.

Where the idea started

Atlas signal au-cyber-incident-exercise-workflows (Australia, confidence55, observed3September2026) pointed to responsibilities and regular response exercises. The independently checked official ISM guidance is dated7September; that provenance difference is retained. Guidance alone did not establish a buyer.

What practitioners actually asked for

A practitioner with existing government scenarios asked for facilitation and review training. Another asked for the final client after-action deliverable. A platform comparison questioned how much report work remains, and a first-time facilitator described a short deadline for an exercise and its evidence.

These are public, unverified self-reports, not representative customer interviews or purchases. They support investigating the recurring facilitation/reporting job.

Why this workflow goes beyond notes

Ten original scenarios cover cyber incidents, SAP BTP, critical systems, releases, migration and enterprise coordination. Inspect fictional evidence, choose a response, see its consequence in the next update, and present the incident without forms on screen. Guidance clips teach the workflow. Your decisions and reasoning then become a readable record with owned actions and portable recovery.

Good alternatives already exist

NCSC’s free exercises, self-hosted Project TAB, capable facilitators with slides and notes, and commercial platforms such as Immersive and Ally are meaningful alternatives. We do not assume missing competitor features from pages we could not inspect.

The official Halkyn service offer and Tabletop.ai software plans show priced offerings. Asking prices establish offers, not sales or willingness to pay for this app.

The research decision

The recurring problem and a priced category have evidence. This app’s adoption and paid demand still need representative use and real buyer commitments. Quantitative search providers did not supply usable data in the checked routes; no high-volume or ranking claim is made. Those commercial tests have explicit owners, methods and decision rules in the reviewed project validation plan, rather than being presented as missing application features.