SERVICE BRIEF

Rapid7 Threat Simulation:
Tabletop Exercises (TTX)
Cultivating the right habits for the moment of needIf your security team is like most, you’re investing heavily in an incident detection and response program. One of the key
steps for any organization is to run a threat simulation in a safe setting to answer the burning question: How prepared are
your team and the security controls in your environment, really?
Rapid7 is here to provide guidance, clarity and expertise through controlled exercises with skilled and versatile security
pros. Our experts are armed with a thorough understanding of threats, triage techniques, attacker behavior, and crisis
communications, and they will be at your disposal throughout the tabletop exercise. The result? An unmatched assurance
that your security team and program are fully equipped in the face of danger (superhero capes not included).

THE RAPID7 APPROACH
EACH SIMULATION IS TAILORED IN ITS APPROACH
We recognize your organization is unique, and as such, we work with the controls you have in place so that the tabletop
exercise (TTX) effectively measures your response relative to your environment. Additionally, each industry is subject to different
threats and regulatory requirements which are taken into consideration in the creation of the scenario and in our response
analysis. The Rapid7 approach to threat simulation with TTX includes the following:
1.

Review of important documents
This includes, but is not limited to, your incident response plan, crisis communications procedures, IT policies, and network
topologies.

2.

Industry and regulatory focus
We work to understand your business model, differentiators, and marketplace to further customize the exercise scenario.
Whether it is client information or R&D blueprints, we understand what is the critical data at risk, and we structure thesimulation accordingly.

3.

Comprehensive assessment of your security program
We take a deep dive into your performance in five major facets of incident response: the maturity of your IR plan, youradherence to that plan, IR coordination, internal and external communications, and technical analysis.

PROJECT METHODOLOGY
Many incident response engagements result in struggle, because security
teams have never executed their proposed plans. Rapid7 will walk you
through real incident scenarios, identify evidence sources, perform mockcommunications, and make recommendations for cleanup and recovery.
A generalized project outline is represented below:
INITIATE

PREPAREDELIVER

RECOMMEND

Rapid7 willmeet with key
personnel to
finalize the scopeof activities,
evaluate
relevant businesscharacteristics,
and assessyour threat
detection andincident response
capabilities.

Rapid7 willdevelop a realistic
scenario basedon many relevant
factors, coordinate
and develop all
pre-TTX materials
for the simulation,
and work withyour team to set
time frames for the
exercise and theresulting report.

Rapid7’s incident
response
engagement
managers will
facilitate theexercise andevaluate yourorganization. We
will then discuss
initial findings andprovide feedback
to the participants.

For a productive
and actionableoutcome, Rapid7
will deliver areport withrecommendations
for improving
threat detection
and incident
response
capabilities acrossyour program.

HANDS-ON APPROACH TARGETING SEVERAL LAYERS OF
THE ORGANIZATIONNEW TO INCIDENTRESPONSE?
Is a threat simulation exercise a step
too far at the moment?
Our Incident Response Program
Development offering helps
organizations become more
proficient at threat detection
and increases readiness to
respond to security incidents withefficient and coordinated actions.
Recommendations and expert advice
provide the foundation for sustainable
investments in people, processes andtechnology to minimize exposure in
the event of a breach.

In the event of a true incident, all hands are on deck: Rapid7 differentiates ourtabletop exercises by going beyond just technical analysis and response toextend to how business owners react, communicate, and manage the event. To
ensure you are armed with a well-rounded approach to incident response, we
also involve stakeholders across your organization, including but not limited to:• Technical teams: Assess how well your technical teams identify, respondto and contain potential incidents.
• Legal representation: Through Rapid7’s understanding of regulatory andfiduciary responsibilities, provide guidance and legal disclosure to thenecessary parties.
• Marketing teams: Understanding that brand equity is paramount, Rapid7
will analyze crisis communication content, cadence, and approach.
Additionally, we provide guidance for crisis communications, includinginternal communications, social media messaging, and public/investor
disclosures.
• Executive teams: A security event is a business event; review yourorganization’s relationship with the executive team, and how underlying
support structures identify and communicate critical information to thebusiness owners.

READY TO STAY A STEPAHEAD OF ATTACKERS?
Contact our sales team at 866.7.RAPID7
or sales@rapid7.com, or learn more at
www.rapid7.com/IR-services.