breachday.io · Spot your gaps. Secure your future.
Breachday is a browser-based platform for running Business Continuity (BC) and Incident Response (IR) tabletop exercises. Facilitators control the session in real time; participants join from any device using a 4-character room code — no accounts, no installs, no setup friction.
Every exercise ends with an audit-ready report mapped to the controls your compliance team actually needs.
A synchronized inject timeline, role-based seating, decision votes, freeform responses, and situation updates — all captured against a per-inject record that becomes your after-action report. The exercise hour itself is the audit artifact.
Participants join in seconds:
- Go to
app.breachday.io/join - Enter the 4-character room code
- Claim a role seat (Incident Commander, Legal, Comms, or any role your org defines)
- Start responding
Works on phones, tablets, and laptops. No onboarding friction for executives, legal counsel, or non-technical stakeholders.
| Feature | Description |
|---|---|
| Scenario Library | Default templates, CISA CTEP-based templates, and real-world public breach scenarios |
| Live Inject Flow | Facilitator-controlled inject-by-inject timeline with timed phases and multi-format responses |
| Role-Based Views | Custom role seats — define any role your org needs |
| Response Formats | Freeform text, yes/no/IDK, confidence slider, and multiple-choice voting |
| Audit-Ready Reports | Auto-generated PDF and JSON after-action reports with timeline, vote tallies, and observations |
| Lessons Learned Tracker | Capture action items from every exercise, assign owners, and track status to completion |
| IT Asset Register | Track assets with criticality, RTO, and RPO — link them to exercises in reports |
| Business Impact Analysis | Map processes, systems, roles, and vendors to understand your real exposure |
| Crisis Communication Plans | Templated comms plans for customers, employees, regulators, and press |
| MSP Partner Program | White-labeled tabletops with fully isolated client orgs and a partner management portal |
Breachday sessions generate structured evidence mapped to the controls auditors check:
- SOC 2 — Incident response and availability controls (CC7.x)
- PCI DSS 4.0 — Requirement 12.10.1 incident response plan testing
- SEC Item 1.05 — Cyber incident response readiness for the 4-day disclosure rule
- ISO 22301 — Business Continuity Management exercise and review evidence
- CISA CTEP — Cybersecurity Tabletop Exercise Package-aligned scenario templates
Hypothetical scenarios are easy to dismiss. Our library is built from:
- Actual public breaches — wire fraud incidents, ransomware events, identity provider lockouts, insider data theft, and more
- CISA CTEP templates — exercise packages from the U.S. Cybersecurity & Infrastructure Security Agency, adapted for sector-specific resilience
Your team rehearses the exact patterns attackers and operational failures keep using, with decision points the U.S. government recommends.
| Plan | Price | Best For |
|---|---|---|
| Starter | $100/mo | Small teams running first tabletops |
| Plus | $250/mo | Growing programs needing CTEP templates, BIA, and saved reports |
| Pro | $500/mo | Mature programs with unlimited scale and full BC program features |
| Enterprise | Custom | Self-hosted deployment with dedicated onboarding |
| MSP / Partners | Volume pricing | White-labeled tabletops for client orgs |
- Realistic pressure — Timed injects and incomplete information simulate the fog of war. Linear slide decks do not.
- Low friction participation — Executives and external counsel shouldn't need a tutorial. A room code and a simple UI make joining effortless.
- Actionable outcomes — If a tabletop doesn't result in concrete improvements to runbooks or architecture, it was wasted time. Our lessons learned tracker ensures follow-through.
- Compliance-ready by default — Every exercise produces an audit-grade artifact mapped to SOC 2, PCI DSS, SEC, and ISO controls — without a separate writing project.
Practice on the good days so you're ready for the bad days.