The first hour decides what the breach costs you.
Incident-response drills for nonprofits
Rehearse that hour with the people who would actually be in the room. No security team, no consultant, and no $30,000 budget.
The scenarios, the hour and the report follow the same public standards that professional exercise facilitators and government agencies use. That is why the report holds up with a funder or an auditor.
- NIST SP 800-84
- HSEEP
- CISA CTEP
- NIST SP 800-61r3
- UK / EU GDPR
Talking about it isn't rehearsing it.
The updates arrive on a timer. Nobody can hold one back by still being mid-sentence — and that is the whole difference between a drill and a meeting.
Without a drill
A plan nobody has opened since the day it was written, and no one is sure which drive it is on.
Authority discovered at 2am — the first test of who can approve disconnecting a server is the real one.
“We'd call the IT company” works right up until somebody checks their opening hours.
No agreed position on paying so the decision goes to whoever in the room is most frightened.
After one hour
Gaps come out in the room where being wrong costs nothing and everybody is watching the same clock.
Decisions recorded against roles never against names, so the report is safe to share inside your team.
A report a funder accepts with findings, fixes, owners and dates, ready to export as a PDF.
Nothing left hanging — every gap you find has a name against it and a date on it before anyone stands up.
You lead the room. The app keeps the time.
- 10 minutes
Set the room
Pick a scenario, name who would really be there, answer five questions about what you already have.
- 60 minutes
Run the hour
Updates arrive on the clock, not when the talking stops. You lead; the app keeps time and captures decisions.
- Same afternoon
Send the report
Findings, owners and dates, drafted from your team's own words and exportable as a PDF.
Not every drill is an hour. Three of the 17 scenarios run in fifteen minutes — one decision, no build-up, the same clock and the same report at the end. An hour needs six people free at the same time. Fifteen minutes fits into a meeting you were already having, which is how most organizations start.
Update 3 of 11 in “Someone else is speaking as you”, one of the 17 scenarios your team can pick from. This is exactly what appears on the shared screen at minute 9, word for word, with the clock running.
Someone else is speaking as you
next in 06:00
09:00
For the Brand & Communications
You are locked out
The Communications lead tries to sign in to the social account to take the post down. The password no longer works. The recovery email and phone number on the account have both been changed to addresses nobody recognizes.
17 scenarios, written not generated.
Every legal deadline names the law it comes from. The app can reword a scenario so it sounds like your organization, but it cannot invent a deadline, change one, or write a scenario of its own.
Ransomware
The shared drive is gone
60 min10 updates
Business email compromise / payment fraud
The bank details changed
60 min9 updates
Device seizure or loss with beneficiary data
The laptop didn't come back
60 min9 updates
Cloud account takeover
Someone else is signing in as the Director
60 min11 updates
Departing-staff insider access
She left on Friday. Her access didn't.
60 min10 updates
Vendor or implementing-partner breach
Our data, their breach
60 min10 updates
Messaging account compromise
That message isn't from the Director
60 min10 updates
Mobile-money and payment-list fraud
The transfers went to the wrong phones
60 min10 updates
Public platform and social account takeover
Someone else is speaking as you
60 min11 updates
Accidental disclosure of personal data
It went to the wrong list
60 min11 updates
Payroll diversion
The paycheck that never arrived
60 min10 updates
Help-desk social engineering
Someone called IT and became the Finance Director
60 min10 updates
Payment card abuse
Your donate button is being used to test stolen cards
60 min9 updates
Targeted harassment and doxxing
Your staff are being named online
60 min9 updates
Authority and escalation
It is 2am and someone has to say yes
15 min3 updates
Reporting and human factors
Someone clicked, and waited a day to say so
15 min3 updates
Payment fraud
The bank details changed by email
15 min3 updates
Prices published, not hidden behind a demo.
If you need a number for a grant budget, you should not have to book a call to get one. The prices are still being set — until then, ask and we will tell you.
Free
Coming soon
One drill, run solo, so you can see the report before you decide anything.
Organization
Coming soon
Unlimited drills, the full library, report exports and action tracking.
Funder or network
Coming soon
Every grantee covered, plus the roll-up across your portfolio.
It ends with the gaps named, owned and dated.
Every gap you find becomes a fix with an owner and a due date, agreed while everyone is still in the room. That is the list of things your organization now knows it has to sort out. The report is good enough to forward to a funder, but it is written for you.
Nobody gets named
Decisions are recorded against a role, never against a person. Practice is where mistakes are free — that is the whole point of rehearsing.
This is a discussion around a table, not a test of your systems. Nothing is installed and nothing you actually run is touched, ever.