A cyber-crisis exercise for the board, the CISO and legal
A data breach surfaces before breakfast. You have one in-game day to decide what to report, to whom and by when, what to tell the press, and whether to pull systems offline. The AI throws in escalations and writes the debrief — the consequences of catalogue actions are authored and fixed, and the score comes from a deterministic scorer.
No sign-up, no install, free.
- Peer-reviewed
- SoftwareX 35
- Open source
- AGPL-3.0
- Cost
- Free
Published inSoftwareX 35 (2026) 102929CC BY 4.0Open source (AGPL-3.0)
How it works
Three steps, the same scenario for every team.
An incident lands in the inbox
Each role sees different messages: the board gets calls from the press, the CISO gets logs, legal gets the regulator's questions.
Urgent — NordBank customer data leak
Decisions against the clock
Pick from a list or write your own. Statutory deadlines keep running, and some options are traps that look reasonable.
Notify the regulator (KNF)
Classify it as a minor incident
A scored debrief
Rules compute the score: the same decisions always give the same result. The AI adds commentary — what worked, what didn't and why.
Team score
72/100 good
Your role: 2 of 3 deadlines met
What you practise
Real EU deadlines and three roles that have to work together in an actual crisis.
DORA // KNF
4 h
DORA — initial notification
NIS2 // CSIRT
24 h
NIS2 — early warning
GDPR // UODO
72 h
GDPR — breach notification
The demo covers the first 24 hours of the crisis; the 72-hour GDPR deadline appears in the full exercise.
Board
Steers the company through the crisis and speaks for it: crisis team, statements, supervisory board, market disclosure.
CISO / IT
Stops the leak and finds out what happened: cut the channel, preserve evidence, bring in DFIR.
Legal
Owns notifications and deadlines: financial regulator, CSIRT, data-protection authority, customers.
Run the exercise with your group
For lecturers and trainers. Create a session in one click, get a code for participants and a secret link to run it. No account — everything runs on our server.
Prefer your own server? Installation guide · Questions and large groups: contact@ksiezopolski.pl
Cite
If you use CSIRT-Sim in research or teaching, please cite the article:
Księżopolski, B. (2026). CSIRT-Sim: An LLM-augmented crisis-decision simulator for cybersecurity incident response in regulated organizations. SoftwareX, 35, 102929. https://doi.org/10.1016/j.softx.2026.102929
@article{Ksiezopolski2026CSIRTSim,
author = {Księżopolski, Bogdan},
title = {{CSIRT-Sim}: An {LLM}-augmented crisis-decision simulator for cybersecurity incident response in regulated organizations},
journal = {SoftwareX},
volume = {35},
pages = {102929},
year = {2026},
doi = {10.1016/j.softx.2026.102929}
}