A user guide for the resilience leads, hosts and members who run incident-response training on the platform — generate, refine, and run live sessions with your own leadership team.
Two hands-on flows on incidentresponse.app — generating a brand-new scenario, and running a live multiplayer session for an executive team. Each section is a numbered walkthrough you can follow start to finish.
The canonical online guide for the five-level refinement ladder that sits between generation and live play — maintained on incidentresponse.app/guides so it stays current.
Five steps from “I need an exercise” to a playable scenario — brief the form, generate, and land on Prepare.
The five-level ladder between generation and live play — from scenario-alone up to live broadcast-media training.
From Prepare to debrief — eight steps to host a live exec exercise and download the review.
Seven step-by-step guides cover the full member workflow online at incidentresponse.app/guides:
Go to incidentresponse.app/start. You’ll see a single-page form with the fields you need to brief the generator.
Fill in the four essentials:
Expand the accordion to fill in any of:
Generation runs in the background — typically 5–8 minutes. A progress bar advances steadily, so you can leave the tab and come back. The page is safe to keep open; do not refresh during the run.
When the bar reaches 100% the page redirects you to /scenario/<id>/prepare — where you configure roles, choose how to play (single- or multiplayer), and add refinements before running the session.
Already have a scenario? Use “Upload a saved scenario” on /start to drop in an XLSX you’ve authored or previously downloaded — same destination, no generation cost.
Want to check, edit or refine the core scenario and its injects? Download the XLSX, review it, and make your changes. Then upload that file — or any scenario you already have — to the library, either as a private scenario or shared for all members to use.
IncidentResponse.app supports delivery across five levels of sophistication. Levels 1–3 you can run yourself; levels 4 and 5 are where the experience starts to feel real — video news bulletins dropped into the scenario feed, and broadcast-media training with our partners at Tech TV.
Core injects only — the scripted backbone of the exercise, run end to end.
Parallel scripted threads layered alongside the core, adding texture and side-decisions.
Ambient noise the room has to filter — the signal-from-noise pressure of a real incident.
Video news bulletins dropped straight into the scenario feed — download the XLSX, enter new injects and mark them as video files with a video URL, and they’ll appear as breaking-news stories on screen during the scenario. No bulletins of your own? We can create some to meet your brief — just get in touch.
Put your team to the test with a live broadcast-media studio experience delivered live via Tech TV — on-camera, in real time. The ultimate immersive experience!
Full descriptions of each level, what each includes, and how to step up the ladder live. It’s updated whenever the level definitions evolve — check there rather than a printed copy.
After generating or uploading, you’ll be on /scenario/<id>/prepare. The page shows the scenario title and lets you allocate the seven blue-team roles (your executive team), the red-team roles (members playing the protagonists), and the support-team roles (external expert advisors — generic, or ones cloned from our directory). Then complete the session preparation as follows:
Add your own branding to any scenario — your logo appears everywhere from the player pages to the training slides and post-session reports. Membership also includes member marketing: provide a logo and the incident types you offer, and we’ll surface them on a shareable marketing page for prospects.
Set up training-session questions, MCQs and learning objectives for each stage. These surface in the Test cells of the host’s picker grid during the session, and also appear in the post-session DOCX review — so the team has a written record of what they learned alongside what they decided.
/scenario/<id>/learning. Choose whether to use the provided MCQs, videos and slides, your own, neither or both — and select exactly which slides to use at incidentresponse.app/academy#training-slides.Personalised emails for each active player containing their unique join URL, role assignment and session details. Only needed in multiplayer mode — single-player and hosted-single-player skip this step.
Every membership includes a set number of hosts, plus unlimited users and guests. Invite your team as hosts or users — each can run multiplayer events and issue joining instructions, or mint tokens for guests to play single-player at their leisure. Each tier caps the monthly scenario generations and the sessions run.
Do the three cards in any order — but branding once, learning materials per scenario, joining instructions per session is cleanest. Branding propagates automatically into the player pages, slides and review report once set.
For each of the seven roles — CEO, CFO, CLO, CMO, CIO, CISO, PRO — choose one of three settings:
Your assignments persist locally, so you won’t lose them on refresh.
The system creates a session and navigates you to the host lobby at /host/<sessionId>. This is a holding screen — the scenario clock has not started yet.
The joining-instructions modal from Step 01 already contains everything the team needs:
/play/<sessionId>/<playerToken>.No joining instructions yet? The lobby exposes the same briefing — copy it from there.
Raises the specificity and relevance of each scenario to your organisation, while massively reducing the time and cost of building one.
Shrinks the team needed to run a scenario by automating roles — right down to a fully playable single-player mode.
Drives graphical macro-models and metrics inside the session, auto-adjusted from events, decisions and sentiment analysis of the messages exchanged.
The lobby shows who has joined. When everyone is in, click “Proceed to the scenario” — this flips the session to live and unlocks the host dashboard.
The dashboard is a three-column war-room: left, the inject queue (emails, IMs, posts waiting to fire); centre, tabs for Team, Metrics, Links and IRC; right, the per-channel message log.
Each part (Part 1, 2, 3) gives you four cells:
Click ▶ Run Next to advance, or click any cell to jump to its first step.
At the end of Part 3 the Conclusion panel unlocks. Click “📋 Review” — this stops the clock and downloads a DOCX report covering the decisions made, the timeline played, and the players’ MCQ answers. It carries your branding, ready to share for the debrief.
Key injects put a choice to specific executives — options A, B and C, with D being “hold off for now.” Each option spells out its upside and downside, and the team has two minutes of real time — not scenario time — to decide before the window closes. Every choice moves the dashboard metrics and is recorded for the final report.
Drag any slider to override its value (0–100). Players see your overrides immediately on their Live Impact rail. Tone follows the value automatically — green / amber / red — and flips for rows where high values are healthy (retention, containment, sentiment, trust).
Drives the player half-dials and the Media Salience meter (press + social). Investor below 50 also pulls share price down.
Operational drives Customer Retention down; Financial counts double in the Cash burn rate; Systemic pulls share price.
Lagging indicators of how the incident bleeds into adjacent stakeholder exposure.
↺ Reset snaps every editable dial back to its nominal. ▲ Escalate +10 / ▼ De-escalate −10 nudge disruption + exposure uniformly — sentiment and stakeholder pulse are untouched. Currency changes Cash-burn formatting only; internal math is always in CHF.
The platform handles the mechanics — you bring the drama. Tweak the scenario, curate slides, mix in training materials, cast red and support teams live, drive the dashboard and these dials, and introduce counter-intuitive tactics like mid-scenario role swaps.
A place to browse, draw on, and contribute to the resources that make a session feel real — five shelves of shared reference material, open to every member.
Every published scenario on the platform — yours and the global pool — filterable by incident type, country, sector and size. Open one to read the brief, download the XLSX, or save it into your own library to run later. The same surface that powers the public /library, plus your own private scenarios.
A roster of named support-team contacts — incident commanders, forensics partners, hostage negotiators, PR retainers — to call on during a scenario or hire for a real event. Filter by discipline, geography and language; tap through to bios, day rates and contact details.
Subject-matter experts available to brief executives in-character during a session, or coach them afterwards: legal counsel, regulators, ex-CISOs, crisis-comms veterans, broadcast journalists. Mirrors the Support Team Catalogue layout — discipline, geography, languages, rates.
Worked examples of the pre-recorded TV news segments that drop into the scenario feed at Level 4 of the refinement ladder. Use them as-is, edit the XLSX to point at your own clips, or commission new bulletins via the Contact button at the foot of the section.
The Level 5 partnership write-up — the live in-studio interview drill delivered with Tech TV. Explains what a session includes, how the booking flow works, and what the executives walk away with: a branded video file they can share.
Know someone who belongs in the Support Team Catalogue or the Expert roster? Nominate them from the Nominations page.
Experts / trainers play the lecturer in a training scenario — framing the discussion, drawing out lessons, debriefing the room. Support-team members are participants — they sit alongside the blue team during the exercise, and would be on the call on the day if the incident were real. Some people are happy in either seat; pick Support team + Expert/trainer for those.
Stand-alone learning content, mapped to the host’s picker grid — Show, Test and Learn each have a home here, and every piece is playable solo as well.
Short, on-demand explainer videos for each of the nine incident-type categories. Used inside a session via the Show cells on the host picker grid, or watched standalone as pre-read for an executive who’s new to the topic.
MCQ banks per incident type — used inside a session via the Test cells on the host picker grid, and also playable solo for individual preparedness. Each correct answer carries an explanation, so the quiz teaches even on a miss.
Slide decks that map to each part of a scenario — used inside a session via the Learn cells on the host picker grid, or exported as standalone tutorial material. They carry your branding once you’ve set it up on Prepare.
Annual tabletops are a tick-box. When the call lands at 02:00, nobody has decided who briefs the board, who briefs the regulator, or who goes on camera.
Build the muscle memory — a simulation that mirrors your organisation, run with your own leadership. Walk into the board update with evidence of preparedness, not a slide.
Clients don’t want another generic walk-through. They want their own boardroom, their own regulators, their own supply chain — under pressure.
Spend billable hours on insight, not slide formatting. Spin up bespoke engagements in the time it takes to brief a junior associate.
Traditional media-relations income is in structural decline. Issues and crisis management is where the value has moved — retainers and a seat at the table.
A simulation opens the door to strategic messaging, executive positioning and reputation counsel. Walk in with the rehearsal; walk out with the next three retainers.
Premiums are rising and capacity is tightening; insureds want more than a policy document. Give them rehearsal — and underwriters real evidence of preparedness.
Bundle simulations into placement and renewal. Differentiate, stick the account, and hand underwriters a quantifiable risk-reduction lever.
In addition to hosted multiplayer sessions — we recommend running these every three months — you can give executives single-player session tokens for supplementary training. A range of token kinds controls exactly what each session becomes.
| Mode | ★ | ★★ | ★★★ | ★★★★ | ★★★★★ |
|---|---|---|---|---|---|
| Token-redeemed single player | ✓ | ✓ | ✓ | — | — |
| Hosted single player Tune ↗ | ✓ | ✓ | ✓ | ◇ | ◇ |
| Hosted multiplayer Tune ↗ | ✓ | ✓ | ✓ | ✓ | ✓ |
You email the XLSX to your client with the token and redemption instructions; they upload it at redemption.
1 sessionClient picks any scenario from the public library matching an incident type you pin. No XLSX to attach.
1 sessionClient gets a freshly generated scenario; you pin both the incident type and the skew (angle) they must play.
1 session + 1 generationClient gets a freshly generated scenario in an incident type you pin; they still pick the angle / skew at redemption.
1 session + 1 generationClient picks the incident type, the skew and everything else at redemption. Maximum flexibility.
1 session + 1 generationConsider the expense of assembling your executive team for a full exercise. If you’re going to run one, you’ll want it as relevant as possible — a scenario tailored directly to their organisation and its operations — and as realistic as possible, which only a fully immersive experience delivers. It doesn’t get more immersive than IncidentResponse.app — with your executives dropped directly into a TV studio for broadcast-media training. Then consider the cost of not running it at all — see, for example, the gap between an organisation prepared for a cyber incident and one that is not:
Plan in a binder. Phones ring in anger.
Bridge tested. Roles known. Muscle memory.
Book fifteen minutes and we’ll walk through how it works for your team.