Cloud Incident Response

Cloud Incident Response Tabletop Excercise

Cloud Incident Response Similation

Documentation for facilitators including instructions, handbooks, feedback form, executive briefing templates, and lessons learned templates.

Revision Date: February 19, 2025

Our tabletop toolkit helps security leaders run effective incident simulations. These pre-built templates guide you through planning, facilitation, participant engagement, feedback collection, and post-exercise lessons learned analysis. Designed for both internal security teams and external security consultants, this material is ready-to-use for self-facilitated workshops or client-facing engagements

Our Cloud Incident Response Toolkit is our Brea-n-Butter! This  toolkit focuses on various aspet of cloud incident response such as root account compirmise, credentia or access key theft or accidental public disclosure. Grounded from the Incident Response playbooks we developed at AWS, proactively learn what to do, who to involve, response activitices, etc. in the event of a cloud environment compromise

For more information or to request a custom workshop, Contact Us.

Tabletop Toolkit Materials (Sample set)


Resource Name File Type File Size Language
Introduction Letter .PDF 120 KB EN
Exercise Planner Handbook .DOCX 723 KB EN
Facilitator Guide & / Evaluator Handbook .DOCX 629 KB EN
Participant Invitation Letter Template .DOCX 87 KB EN
Participant Feedback Template .DOCX 253 KB EN
Exercise Briefing Slide Deck Template .PPTX 499 KB EN
Lessons Learned & After Action Report Template .DOCX 450 KB EN


How to Get Started