simlerCrisis Readiness
See how your organization responds when not everyone knows the same thing.
In a crisis simulation, every role gets its own information, just like the real thing. Security sees the logs, communications has a journalist on the line and the executive team wants to know whether customers need to be told. Together, they have to get the incident under control.
Why a crisis gets stuck
Almost every organization has an incident response plan. But a plan says little about what happens when things really go wrong at half past nine at night.
The plan has never been tested under pressure
The incident response plan has been approved and filed away. Whether the team can carry it out while systems go down and the phone won't stop ringing, nobody knows.
Information gets stuck
Every role knows something different, and a crisis stalls on what isn't passed on: a detail from the logs the executive team hears too late, or a promise to a customer that IT knows nothing about.
Practicing costs too much
A realistic exercise takes weeks of preparation, someone to write the script and often an outside facilitator. So it happens once a year, or not at all.
One incident, five screens
Everyone sees a different piece of the same incident
In a crisis simulation, every role only gets its own messages. Within half an hour, everyone knows something the others don't. Only when they share information does the whole picture emerge. That is exactly what you practice.
IT
9:12 PMSIEM alert
Mass encryption on 14 file shares. Write rate 40× normal.
Only IT sees this
Security
9:15 PMLogin alert
Account j.vermeer signed in at 8:52 PM from an unknown location. The MFA prompt was approved.
Only Security sees this
Legal
9:31 PMEmail from the hosting provider
“We see large outbound data flows from your CRM. Personal data may have leaked.”
Only Legal sees this
Communications
9:38 PMPhone
A journalist: “Is it true that customer data is on a leak site?”
Only Communications sees this
Executives
9:45 PMHave to decide now
Ransom note: 40 BTC within 24 hours. Pay, report, or find out more first?
Don't know yet: that data was stolen, that the regulator's reporting deadline is running and that the press is calling.
How a crisis simulation works
simler observes how the team communicates, escalates and decides, and turns that into a debrief backed by evidence.
- 1
Add your plans
OptionalYour information security policy, incident response plan, business continuity plan and disaster recovery plan make the scenario specific to your organization. Don't have them yet? simler drafts them with you. Connect your systems via MCP as well, and the scenario names your real systems and owners.
SampleDocuments
Your plans
- Final
Information security policy
Drafted with simler
- Final
Incident response plan
PDF
- Draft
Business continuity plan
PDF
- Let simler draft it
Disaster recovery plan
Not there yet
ConnectedYour systems
Connected via MCP, read-only
Final plans go into the scenario by default.
- 2
Choose a scenario
Ransomware, a data breach, a supplier outage or a current threat. simler builds the scenario for your organization, with the plans and systems you added.
SampleScenario
Ransomware: encrypted user data and CRM systems
Opening brief
Monday, 9:28 PM. The SIEM reports mass encryption across 14 file shares, and there's a ransom note.
How the attacker got in isn't in there. The team has to work that out.
Key facts
- Affected
- 14 file shares and the CRM
- Ransom
- 40 BTC within 24 hours
- Customer contacts
- Around 41,200
- Early warning
- Within 24 hours
Based on
- Incident response plan
- Business continuity plan
- Current threat (NCSC)
- 3
Fill the roles
You see the scenario and the roles up front. Up to 10 people take part, each in their own role. Roles you can't staff, simler plays.
SampleRoles
Who plays what
- CTOPerson
- CEOPerson
- CRM OwnerPerson
- Data Protection Officersimler
- External Legal Counselsimler
- Lead Engineersimler
You adjust the roles before you start.
- 4
Choose how the incident unfolds
simler lines up messages for each role on a timeline, rising in severity. Choose a fixed script you read and edit in advance, or let simler write the messages during the exercise, based on what the team says and does. Then you get surprised too.
SampleMessages
How the incident unfolds
- 0 minLow
Lead Engineer
Written during the exercise
- 4 minMedium
CRM Owner
Written during the exercise
- 9 minHigh
CEO
Written during the exercise
- 15 minHigh
Data Protection Officer
Written during the exercise
Timing, role and severity are fixed. simler writes the text based on what the team says and does.
- 0 min
- 5
Practice live in the war room
30 to 120 minutes. Messages and developments arrive per role. Stuck? Ask the facilitator for a hint.
SampleWar room
During the exercise
9 min · CEO only
A major customer calls: is our data out in the open?
War room
CEO
I have a customer on the line. Do we know yet whether customer data is gone?
Lead EngineerAI
We're seeing outbound traffic from the CRM server. I'm working out what left.
Facilitator · only you see this
You: What should we be watching right now?
Facilitator: Take a look at the reporting deadlines. Who's keeping track of those?
- 6
An audit-ready debrief
Afterwards, simler writes the debrief: a score per role, response times, missed steps and recommendations, backed by what was said in the war room. Download it as a PDF for your auditor or regulator.
SampleDebrief
Ransomware on the file servers
Score per role
- CTO82
- CEO71
- CRM Owner64
- External Legal CounselAIPlayed by simler, not scored
Response time per message
- Encryption found → shares isolated4 min
- Customer data hit → executives informed2 h 10 min
Missed steps
Prepare the report to the regulator
Expected from: Data Protection Officer
Evidence
09:28 PM CTO “Lead Engineer — isolate those shares and kill j.vermeer's sessions. Now.”
Findings point to the moment in the war room where it happened.
- 7
Improve and test again
Missed steps go straight onto your action list. The next simulation picks up the open items, and your readiness score shows whether it's working.
SampleAction list
From missed step to retest
Missed step from the debrief
Prepare the report to the regulator
Regulator reporting playbook
Owner: Data Protection Officer
In progressSeverity: highRetestNext crisis simulation
Test again: regulator reporting playbook
64Readiness score
+6 since the previous simulation
Documents
Your plans
- Final
Information security policy
Drafted with simler
- Final
Incident response plan
PDF
- Draft
Business continuity plan
PDF
- Let simler draft it
Disaster recovery plan
Not there yet
Your systems
Connected via MCP, read-only
Final plans go into the scenario by default.
Scenario
Ransomware: encrypted user data and CRM systems
Opening brief
Monday, 9:28 PM. The SIEM reports mass encryption across 14 file shares, and there's a ransom note.
How the attacker got in isn't in there. The team has to work that out.
Key facts
- Affected
- 14 file shares and the CRM
- Ransom
- 40 BTC within 24 hours
- Customer contacts
- Around 41,200
- Early warning
- Within 24 hours
Based on
- Incident response plan
- Business continuity plan
- Current threat (NCSC)
Roles
Who plays what
- CTOPerson
- CEOPerson
- CRM OwnerPerson
- Data Protection Officersimler
- External Legal Counselsimler
- Lead Engineersimler
You adjust the roles before you start.
Messages
How the incident unfolds
- 0 minLow
Lead Engineer
Written during the exercise
- 4 minMedium
CRM Owner
Written during the exercise
- 9 minHigh
CEO
Written during the exercise
- 15 minHigh
Data Protection Officer
Written during the exercise
Timing, role and severity are fixed. simler writes the text based on what the team says and does.
War room
During the exercise
9 min · CEO only
A major customer calls: is our data out in the open?
War room
CEO
I have a customer on the line. Do we know yet whether customer data is gone?
Lead EngineerAI
We're seeing outbound traffic from the CRM server. I'm working out what left.
Facilitator · only you see this
You: What should we be watching right now?
Facilitator: Take a look at the reporting deadlines. Who's keeping track of those?
Debrief
Ransomware on the file servers
Score per role
- CTO82
- CEO71
- CRM Owner64
- External Legal CounselAIPlayed by simler, not scored
Response time per message
- Encryption found → shares isolated4 min
- Customer data hit → executives informed2 h 10 min
Missed steps
Prepare the report to the regulator
Expected from: Data Protection Officer
Evidence
09:28 PM CTO “Lead Engineer — isolate those shares and kill j.vermeer's sessions. Now.”
Findings point to the moment in the war room where it happened.
Action list
From missed step to retest
Missed step from the debrief
Prepare the report to the regulator
Regulator reporting playbook
Owner: Data Protection Officer
Next crisis simulation
Test again: regulator reporting playbook
Readiness score
+6 since the previous simulation
Crisis Readiness
For organizations that want more than the board to practice: the rest of the organization too, each in their own role. Includes all tabletop exercises for the board.
€498/ month in the first year
40% off in the first year
€5,976 in the first year, then €9,960 per year. Billed annually, excl. VAT.
- Unlimited crisis simulations in the war room
- Unlimited tabletop exercises with the board
- Scenarios based on your own plans and organization
- simler plays the roles you can't staff
- Score per role, response times and missed steps in the debrief
- Improvement points on your action list and a readiness score
- Up to 10 participants per exercise and 15 accounts
Frequently asked questions
How many people can take part?
Up to 10 people per exercise, each in their own role. Your organization has 15 accounts. Roles you can't staff, simler plays, so the exercise is always complete.
How long does a crisis simulation take?
You choose: 30, 60, 90 or 120 minutes.
How much preparation does it take?
Once your plans are in simler, a tailored exercise is ready in about ten minutes. simler writes the scenario, the roles and the messages; you review everything before you start.
Can we practice in Dutch or English?
Yes, either. The scenario, the messages, the roles simler plays and the debrief are fully in the language you practice in.
Which documents do we need?
No document is required. With your information security policy, incident response plan, business continuity plan or disaster recovery plan (as a PDF), the scenario becomes more specific to your organization. Don't have a plan yet? simler drafts one with you.
How is this different from Boardroom Readiness?
In a tabletop exercise, the board talks an incident through together, round by round, on one shared screen. In a crisis simulation, everyone plays their own role live, with their own information. Crisis Readiness includes both.
Can we try it first?
Yes. With a free account you generate a scenario for your own organization and review all of it: the scenario, the roles and the timeline. Starting it requires a subscription. You can play a ready-made crisis simulation and tabletop exercise for free, debrief included.
See in 30 minutes how simler fits your organization
We show you what an exercise for your organization looks like, from scenario to debrief.
- Built in the Netherlands
- Exercises in Dutch or English
- Aligned with NIS2 and the Dutch Cyberbeveiligingswet