--- title: "Cybersecurity Assessments and Tabletop Exercises – Cybertivité" description: "Cyber risk assessments, maturity evaluations, awareness programs, social engineering simulations and AI-assisted tabletop exercises." canonical: https://www.cybertvt.ca/cybersecurity/ lang: en-CA --- Cybersecurity # Know Your Real Exposure. Rehearse the Response Before You Need It. We assess, test and strengthen your security posture, and prepare your teams and executives to respond to the attacks most likely to hit your organization. Explore services AI-assisted tabletop exercises What we do ## From Assessment to a Security Culture That Holds. ### Cyber Risk Assessment We identify the threats, vulnerabilities and business impacts that matter for your organization, and turn them into prioritized, practical recommendations. **You receive:** risk register, heat map, prioritized treatment plan ### Cybersecurity Maturity Evaluation A review of your policies, practices and technology against the framework that fits you: a recognized standard (NIST CSF 2.0, ISO/IEC 27001:2022, CIS Controls v8), your own internal framework, or a tailored one we build from these standards. You’ll see where you stand and what to fix first. **You receive:** maturity scores by domain, gap analysis, 12–24 month roadmap ### Security Awareness Program Design or revamp of your program: current-state review, policy, vendor selection, phishing simulations, dashboards and continuous improvement. **You receive:** program framework, annual plan, effectiveness metrics ### Cybertivité in Action: Awareness Workshops Interactive security awareness sessions built on real scenarios from your industry, teams and risks. Instead of watching slides, participants practise spotting and responding to threats through gamification. **You receive:** in-person session, visual takeaways, follow-up actions ### Social Engineering Simulations Tailored vishing, spear-phishing and AI deepfake scenarios, plus physical intrusion tests such as attempting to enter your offices or restricted rooms, that show how your people respond to realistic, targeted attacks. Run under written authorization and agreed rules of engagement, with executive consent for any voice or video impersonation. **You receive:** campaign plan, results by team and attack type, targeted coaching ### Incident Response Exercises Cyber incident tabletop exercises at the technical, tactical or executive level, plus functional and full-scale exercises that test your incident response plan, team coordination and executive decision-making. **You receive:** exercise design, facilitation, after-action report Featured service ## AI-Assisted Tabletop Exercise Scenarios, Built from Your Real Exposure Most tabletop exercises run on generic scenarios. Ours are generated from your organization's own applications, vulnerabilities and response procedures, so every inject reflects a risk you actually carry. More realistic scenarios for teams and executives Full traceability to vulnerabilities and procedures Faster preparation, repeatable every cycle ### How the Scenario Pipeline Works 1. **Collect**: Applications, known vulnerabilities, threat intelligence and incident response procedures. 2. **Correlate**: Map applications to vulnerabilities, threat actors, TTPs and the response processes they trigger. 3. **Generate**: Multi-phase attack narratives with injects, decision points and expected response actions. 4. **Validate**: Every inject is traced back to a real vulnerability and procedure. Generic filler is removed. 5. **Deliver**: Facilitation-ready package for the exercise team and participants. 6. **After-Action Report**: What worked, what failed, and how teams and executives made decisions during the exercise. 7. **Action Plan**: Prioritized recommendations with owners and deadlines to close the gaps the exercise revealed. ### What Your Facilitation Pack Includes A scenario storyline in phases, from initial access to recovery Timed injects linked to specific vulnerabilities and assets Decision points for technical teams and executives Expected response actions mapped to your IR procedures A traceability matrix for audit and lessons learned ### Why It Matters Scenario writing is usually manual and slow: it ties up several resources and needs sign-off from multiple teams (vulnerability management, penetration testing, business lines, compliance and more). As a result, exercises run rarely and stay generic. This approach turns it into a scalable, data-driven and repeatable capability. You can run exercises more often, on the threats that really apply, and show regulators and boards how each one ties to your actual risk. ### How Your Data Is Protected Your data never leaves your organization. The agent runs inside your own environment, on-premises or in your cloud tenant. We don’t collect or export your data. Built on your approved AI platform. The agent uses the enterprise-licensed AI platform your organization has already approved, under your existing security and contractual controls. Tuned only on your material, only if you choose. Where you already have plans, past exercises or post-incident reviews, they can be used to sharpen the agent, internally. Otherwise, nothing is used. You own the result. At the end of the engagement, the agent and its configuration are handed over to your team and stay with you. NDA first. We sign your non-disclosure agreement before any information is shared. ### Two Ways to Work with Us Option 1 Exercise as a Service We generate, validate and facilitate the exercise for you, from scenario design to after-action report. Option 2 Your Own Reusable Scenario Agent We design, develop and implement an AI agent connected to your infrastructure, application inventory and vulnerability data. Your team can then generate fresh, validated scenarios as often as needed, each one reflecting your current exposure. Built around your infrastructure and tools Reusable without limit as your environment evolves Implementation, handover and team training included Exercise formats ## Choose the Level of Pressure We recommend a progression, starting with discussion and building to live simulation as your program matures. Walk-through Review the plan step by step Tabletop Discussion-based scenario Functional Teams and systems activated Full-scale End-to-end live simulation Cybersecurity Business Continuity Disaster Recovery Crisis Management ### Integrated Exercises: One Exercise, Several Requirements Required to run business continuity, crisis management, disaster recovery and cybersecurity exercises? Instead of holding three or four separate ones, we can combine them into a single multidimensional exercise. We start from each one’s regulatory and internal requirements, then build a scenario that tests several teams at once: IT, security, operations, communications and executive leadership. - Every requirement covered, with traceability for audit and regulators - Less time taken from your teams and executives - A realistic scenario where a cyberattack also triggers a crisis and a recovery - One after-action report and a consolidated action plan Aligned with NIST CSF 2.0, ISO/IEC 27001:2022 and CIS Controls v8. Regulatory experience ## Programs That Stand Up to Regulators Readiness assessments, action plans and exercises for regulated financial institutions, built to meet regulatory expectations, not just internal ones. OSFI (BSIF) Federally regulated financial institutions Readiness assessments and action plans aligned with OSFI guidelines: B-10 · Third-party risk management B-13 · Technology and cyber risk management E-21 · Operational resilience and operational risk management AMF Autorité des marchés financiers, Quebec Readiness assessments and action plans aligned with AMF guidelines on information and communications technology risk, business continuity and third-party risk for Quebec financial institutions. International Capital Markets International offices and subsidiaries Tabletop exercises for the international offices and subsidiaries of a Canadian bank's capital markets division, each operating under its local regulatory framework. New York Florida London Dublin Paris Hong Kong > On tabletop exercises for our international and local Capital Markets offices, Serge consistently showed a strong command of the subject and a proactive approach. His expertise and attention to detail have made our exercises more engaging, realistic and impactful. **S.Y.** · Associate Director, Capital Markets, National Bank of Canada [More from clients and colleagues](https://www.cybertvt.ca/our-story/) ## Not Sure Where to Start? We'll Help You Scope It. Share what worries you most, and we’ll suggest where to start: an assessment, an exercise or an awareness program. info@cybertvt.ca (514) 424-3961 [LinkedIn](https://www.linkedin.com/in/serge-el-hage-101102220/) ### What Happens Next 1. **We reply within one business day.** 2. **A 30-minute scoping call.** We can sign your NDA beforehand. 3. **A written proposal** with deliverables, timeline and fees. Based in the Greater Montreal Area Serving clients across Canada and internationally