I have been doing tabletop exercises for the past decade. The traditional model is filled with structural issues that most practitioners know about but don’t talk about. Reflex actually fixes them. The scenario engine is a core improvement. Based on as little or as much information as you want to feed it, Reflex builds the attack vector, the threat actor and the organizational context. What usually took weeks of scenario development and stakeholder coordination can be done in under a few hours. That time compression, and quality of the output, significantly changes what I can do for an organization. Participant engagement is where most exercises fall apart. You know the look. Technical teams being asked to suspend disbelief because of unrealistic assumptions, or exec teams on their phones, half-checked out. Reflex solves that too. Everyone gets their own console tuned to their role. AI agents participate as attackers and as colleagues who aren’t part of the formal exercise. They’ll ask questions, make noise, put on a lot of pressure. A facilitator doesn’t provide every inject. Each participant has to bring what they are finding to the team which is so much more realistic. The reporting is very good. You get an all-encompassing transcript showing how people found information, how they communicated with others when they were under pressure, and what decisions they took and when. And that’s a whole different level of insight than a quick hot wash at the end of a traditional session. One thing I didn’t expect to see going in: I started using Reflex for cyber tabletops and quickly realized it handles BCP/DR, crisis communications, and enterprise risk scenarios just as well. That’s opened conversations well beyond the security team.

Its ability to create a highly realistic, company-specific simulation that exposes real weaknesses in our incident response under pressure. This was not a generic exercise — it was tailored to our tech stack, clients, and regulatory environment, which made it feel like a real incident.