Questions before your first exercise.

TTX stands for tabletop exercise. Cyber Ambush is a live, cloud-based platform for running cyber tabletop exercises. It replaces static slide decks and printed injects with a real-time scenario clock, structured roles, and an artificial intelligence (AI) supported after-action review (AAR), so organizations can rehearse incident response without weeks of manual preparation.

Public and private sector organizations that need to test incident response plans, teams, and decision-making — security teams, information technology (IT) leadership, legal and communications functions, and the executives who ultimately own the outcome of a real incident.

A slide-based tabletop is static: the same injects fire in the same order regardless of what participants decide, and scoring the exercise afterward is manual and slow. Cyber Ambush runs on a live clock, lets an Operator adapt the scenario as decisions are made, and generates a structured after-action review immediately after ENDEX — the formal end of exercise.

Executive Sponsor sets objectives and scope and owns the results. Operator facilitates the live session, pacing injects and adjudicating the scenario. Participants respond to the unfolding situation as they would in a real incident.

Demo mode lets an Executive Sponsor or Operator preview a scenario, pacing, and injects before committing to a real session, with no scoring or record kept. Live mode runs the full exercise with real participants, a running clock, and produces a real after-action review and improvement plan.

Minutes, not weeks. Because decisions, timestamps, and inject responses are captured as the exercise runs, the after-action review and improvement plan can be generated immediately after ENDEX instead of being assembled by hand afterward.

No — by design. Artificial intelligence supports Executive Sponsors and Operators only, so Participant responses reflect real judgment. Giving Participants AI assistance during play would mask how the team would actually perform in a real incident, which defeats the purpose of the exercise.

No. Cyber Ambush runs entirely in the browser. Participants join a live session with a 6-character code — no accounts, plugins, or downloads required.