AI tabletop exercises for SOC 2
ProYour auditor will ask when you last tested your incident response plan. SimpleAudit's AI writes a tabletop exercise from what you already recorded: your systems, vendors, risks and critical business functions. Each act brings exhibits on screen, such as an email, a ransom note, a news headline or a status page, and your team decides what to do next. Run it on your usual video call by sharing the full-screen stage view, or work through it alone as a solo walkthrough. When you sign off the after-action report, it is saved to your evidence vault for your audit. Incident response, business continuity and disaster recovery exercises are all included.
Updated
Read the transcript
The plan nobody has tested. Your auditor asks when you last tested your incident response plan. The plan exists, but nobody has ever run it. You hire a consultant for a day, or you skip the test and hope the question does not come up again. SimpleAudit writes an incident exercise around your own systems and vendors, and your team works through it on your usual video call. You record each decision as the ransom note and the news headline appear on screen. You sign off the after-action report, it is saved as evidence, and your answer to the auditor is a date and a document.
When did you last test your incident plan?
The plan nobody has tested
The moment
Your auditor asks when you last tested your incident response plan. The plan exists, but nobody has ever run it.
Without SimpleAudit
You hire a consultant for a day, or you skip the test and hope the question does not come up again.
With SimpleAudit
SimpleAudit writes an incident exercise around your own systems and vendors, and your team works through it on your usual video call. You record each decision as the ransom note and the news headline appear on screen.
The outcome
You sign off the after-action report, it is saved as evidence, and your answer to the auditor is a date and a document.
How it works
Choose the exercise
Pick incident response, business continuity or disaster recovery. The AI writes the scenario from your own systems, vendors and critical functions.
Run it with your team
Share the stage view on your video call, reveal each act and its exhibits, and record what your team decides. Or run it alone as a solo walkthrough.
Sign off the report
Review the after-action report the AI drafts from the session, sign it off, and it is saved as evidence for your audit.
Key capabilities
Built from your own company
The scenario names your real systems, vendors and critical business functions, taken from what you already keep in SimpleAudit, including your business impact analysis, risks and policies. It is not a generic script.
Exhibits that make it real
Each act reveals exhibits on screen: emails, chat messages, a ransom note, a news headline, a status page or a social post. Your team reacts to what they see, the way they would on the day.
Run it on your usual call
Open the full-screen stage view and share your screen on Teams, Zoom or any video call. You record each decision as you go, or players vote from their phones after scanning a code.
A solo walkthrough for small teams
If it is just you, run the same exercise as a solo walkthrough. You still get the debrief and the after-action report.
The report becomes audit evidence
After the debrief, the AI drafts the after-action report with strengths, gaps and observations. You review it and sign it off, and the PDF is saved to your evidence vault.
Gaps turn into follow-ups
Accept a gap from the exercise and it becomes an action with an owner, so the weakness you found gets fixed before the next one.
Try the sample first
A built-in sample exercise, a ransomware attack on a file server, shows how a session runs without using any data from your account.
Why we built it this way
“Most small teams have an incident plan that nobody has ever run, and the usual fix is a consultant and a day of everyone's time. I wanted a tabletop you can run on a normal team call, built from your own systems, that leaves the evidence your auditor needs behind when you finish.”
Joe, Founder
Frequently asked questions
Does SOC 2 require a tabletop exercise?
Not by name. SOC 2 expects a documented incident response plan that you test at least annually, through a tabletop exercise or a simulation. For most small teams a tabletop is the simplest test, and the signed-off after-action report is the usual evidence. SimpleAudit saves that report to your evidence vault when you sign it off.
Can I run a tabletop exercise if it is just me?
Yes. Choose a solo walkthrough and work through the same scenario, exhibits and decisions on your own. You still get a debrief and an after-action report to review and sign off, and it is saved as evidence like any other exercise.
Ready to try AI Tabletop Exercises?
Included on Pro. Start a 7-day free trial on Pro to use AI Tabletop Exercises during your trial. No credit card required.