WHEN THE
BREACH HITS —
have you practiced?
The organizations that survive cyber incidents aren't the ones with the most expensive tools. They're the ones that practiced. Mjolnir's wargaming builds the muscle memory your leadership, security, and legal teams need — before the real crisis arrives.
Most IR plans look good
on paper. Only.
Most organizations have a written IR plan. Some correlate it against playbooks and run basic tabletop exercises. Mjolnir takes organizations well beyond that baseline — into the kind of practice that creates real readiness.
Every scenario Mjolnir runs is drawn from actual breaches our team has responded to — adapted to your industry, regulatory environment, and organizational structure. Participants face the same ambiguity, time pressure, and competing priorities that characterize real cyber crises.
Tabletop exercises are the baseline that most organizations aspire to. Mjolnir's wargaming platform takes cross-functional teams through multi-stage scenarios that escalate in complexity, force difficult tradeoff decisions, and surface the gaps your written plan will never reveal.
Threat Landscape Evolves Constantly
New TTPs, ransomware groups, and attack vectors emerge every quarter. Last year's scenario is already outdated. Annual exercises incorporate current threats relevant to your industry and crown jewels.
Teams and Plans Change
Staff turn over. Acquisitions happen. Playbooks get updated. A plan that worked in February may have critical gaps by December. Wargaming surfaces those gaps before attackers do.
Regulatory Bodies Expect It
OSFI B-13, DORA, NIS2, SEC cybersecurity rules, and most cyber insurance underwriters now expect demonstrable evidence of periodic crisis preparedness testing. Annual wargaming creates that evidence trail.
Muscle Memory Has an Expiry Date
Crisis response competency degrades within 12 months without reinforcement. Annual exercises are the minimum threshold to maintain operational readiness when seconds count.
Four formats.
Every audience covered.
From SOC analysts to boards of directors, every stakeholder in a cyber crisis plays a different role. Our exercises are designed around audience — not retrofitted from a single template.
Tabletop Exercises
Discussion-based simulations where participants walk through a cyber incident scenario, making decisions at each stage. Facilitators inject new developments, complications, and escalations to test how teams adapt under pressure and whether response procedures are practical and well-understood.
- Custom scenario design based on your industry threat profile
- Multi-stage injects that escalate complexity and force tradeoffs
- Cross-functional: IT, Security, Legal, HR, Communications
- Facilitated by responders who have worked real crises
- After-action report with gaps and improvement recommendations
Breach Simulations
Beyond discussion — participants respond to simulated alerts, make containment decisions with incomplete information, draft communications under time pressure, and coordinate across departments as the scenario evolves based on their actual decisions in real time.
- Ransomware: encryption discovery, ransom decisions, recovery
- Data breach: PII exposure, regulatory timelines, class action
- Business email compromise and wire fraud recovery
- Supply chain compromise cascading into your environment
- Destructive attacks: wiper malware, OT/ICS, safety systems
Executive Crisis Training
When a major incident occurs, executives must make high-stakes decisions with limited information and immense time pressure. Should we pay the ransom? When do we notify regulators? What do we tell customers? These decisions define the organization's future.
- C-suite strategic decision-making during active crises
- Legal: breach notification, privilege, disclosure timing
- Crisis communications: statements, media, customer notices
- Business continuity: what to sustain, degrade, or shut down
- Ransom payment decision framework — legal, ethical, practical
Board-Level Scenarios
Boards bear ultimate governance responsibility for cybersecurity risk. Our board wargames educate directors on the threat landscape, test understanding of response capabilities, and prepare them for strategic decisions during a significant cyber event.
- Strategic complexity, not technical detail
- Governance and fiduciary duty in cyber incident response
- D&O liability and cyber insurance claim scenarios
- Regulatory and law enforcement engagement decisions
- Stakeholder communication and reputation management
From scoping to after-action
in four stages.
Exercises typically run 4–6 weeks from initial scoping to delivery. Every engagement begins with a threat-profiling session and ends with a written, actionable after-action report.
Scoping & Threat Profiling
We interview your security, legal, and business leadership to identify your most likely threat scenarios, crown jewels, and regulatory obligations. No off-the-shelf exercises.
Custom Scenario Design
Our DFIR team builds a multi-stage scenario drawn from real incidents, calibrated to your industry, team size, and audience. Injects are sequenced to escalate pressure and surface gaps.
Facilitated Exercise
An experienced Mjolnir incident responder leads the session, introducing complications and escalations in real time. Participants make real decisions. The scenario responds. Pressure is genuine.
After-Action Report
A detailed report documents what worked, what failed, and specific recommendations for response procedures, communication plans, decision frameworks, and technical controls.
This principle reflects 570+ real-world incident response engagements Mjolnir Security has led across financial services, healthcare, critical infrastructure, legal, and public sector organizations across Canada and internationally.
Ready to
stress-test
your response?
Tell us about your organization and we'll design a wargaming exercise calibrated to your specific threat profile, team structure, and regulatory environment. Exercises typically run 4–6 weeks from scoping to delivery.
- ✓ Custom scenario built from your threat profile — never off-the-shelf
- ✓ Facilitated by IR professionals who have worked real incidents of comparable severity
- ✓ Detailed after-action report with prioritized improvement recommendations
- ✓ Applicable to OSFI B-13, DORA, NIS2, SEC cyber disclosure readiness
- ✓ Canadian-owned, Canadian data residency — no third-party data exposure
- ✓ Available as single exercises or annual program retainers
Request an Exercise
Request Received
A member of our team will reach out within one business day to discuss your exercise.