Blue Team security services and exercises
We run tabletop exercises (talking a realistic incident through, one decision at a time) and hands-on drills with the people who would handle a real incident. Together we test your incident response plan, your written response procedures and your logs, and find the gaps while they are still cheap to fix. Every exercise is defensive: nothing is attacked.
What we do
Four exercise formats, each able to run on its own: tabletop exercises for decision makers, and drills, detection checks and playbook reviews for the teams. Then two kinds of cyber defense consulting, before and between exercises, put the basics in place and keep them current.
We walk a realistic scenario through your plan, one decision at a time: ransomware on a file server, a leaked cloud access key or a breach at a supplier. The room says what it would do next. Every point where the plan is silent, or where two people expect to decide, is written down.
The people who would do the work rehearse one procedure end to end, such as isolating a computer, changing a leaked password or key, or restoring a service from backup. It shows whether the steps work as written, and where they depend on access or knowledge only one person holds.
We replay log samples or create harmless test events that match what a detection rule looks for. Does the alert fire, does it reach a person, and does your team handle it the way the runbook says? Nothing is broken to prove the point, and every test event is agreed with your team first.
We read each playbook and runbook against the systems, tools and owners you have today. Typical gaps: outdated contact names, tools that have been retired, and steps that need access nobody on the on-call roster holds.
Before the first exercise, we read your incident response plan, contact lists, log collection and retention, decision rights, and your reporting deadlines to regulators, customers and insurers. We then tell you which scenario would teach you the most. If there is no plan yet, we say so, and the plan comes first: see incident response readiness.
Between exercises, we test on paper who is called, who decides, who may take a service offline, and how regulators such as CERT-In (the Indian Computer Emergency Response Team), customers and insurers are told. Each role gets a named deputy. We also set out what evidence to preserve, who may touch it and where it is stored, so the response does not spoil an investigation. Both go into your runbooks.
Defensive work only
An exercise follows the chain your defenders rely on when something goes wrong: how an alert is noticed, who it goes to, who decides on containment (stopping the damage from spreading), and how you tell staff, customers and regulators. The aim is to find the weak links while finding them is still cheap.
SecWiz focuses on defense, remediation and operational resilience. An exercise measures how your defense responds, not how far anyone could get into your systems.
The people who would act in a real incident: security, IT operations, the engineers who own the affected systems, legal, communications and the leaders who approve containment and disclosure. Everyone else is reached through security awareness training, which teaches staff to spot and report a suspicious message.
After the exercise
An exercise rarely finds only one kind of gap. Match what yours found to the service that closes it.
Vulnerability management confirms each weakness, sets its patch priority and checks it again after the fix. A cloud security review reads your setup against a named benchmark. SOC readiness gets your own security operations center (SOC), or the provider you chose, ready to act on alerts. Boards can also rehearse their own decisions in executive tabletop exercises. For the full list, see our defensive cybersecurity services.
How we work
The same five steps for every format.
Both come from your own risks, past incidents or threat model (a written list of what could go wrong in your systems). They are agreed in writing with a named owner before anything runs, together with what is out of bounds.
Participants get the ground rules in advance, and nobody is judged individually. We gather the plan, runbooks, contact lists and any log samples the scenario needs.
The scenario unfolds in stages. Where detection is checked, the agreed test events or log replays run in the window your team set, with your exercise owner present.
We note against the plan which step worked, which owner was missing, which log was not there and where a decision stalled.
Improvements are exercised again, so the record shows each gap closed, not only found.
What you receive
Written for two readers: leadership, who need the decisions, and the teams, who need the detail.
The scenario, the decisions taken and the gaps observed. It opens with a plain-language summary for leadership, then gives your teams the detail they need to act.
Improvements ranked by risk, each with an owner you name and a date you set. Progress is followed between exercises instead of rediscovered at the next one.
Playbook and runbook changes drafted for your approval, with contact lists corrected. The next exercise tests the new version, not the old one.
Where an exercise stops. It finds and records gaps. We draft the playbook, runbook and contact-list changes; other fixes go to an owner you name, or to one of the services under After the exercise.
FAQ
A Blue Team exercise rehearses how your defenders detect, escalate and respond to an incident, using tabletop discussion, drills, benign test events and replayed logs. It measures your plan, people and logging, not how far anyone could get into your systems.
No. SecWiz focuses on defensive security. Exercises use discussion, harmless test events and log replay, and any technical step is agreed in writing with your team before it runs.
A tabletop exercise talks a whole scenario through with decision makers to find gaps in the plan. A drill practises one procedure hands-on with the people who would carry it out.
The people who would act in a real incident: security and IT operations, the engineers who own the affected systems, and the managers who decide on containment, legal notification and communication.
No. Many teams run their first exercise with an incident response plan and a handful of log sources. The exercise shows what to build next, and our threat detection support covers SOC readiness.
Often enough to test each significant change to your systems, team or plan, and at least as often as your framework, regulator or customer contracts require. We help you set a cadence you can keep.
Let's talk
Name the incident that worries you most and who would have to decide what to do. We will propose an exercise built around it. We reply within one working day.