About IncidentCraft

IncidentCraft is an interactive, choose-your-own-adventure simulation platform that gamifies cyber security incident response training for teams. Instead of reading a policy or sitting through a slide deck, players step inside a live incident — a ransomware detonation, a business email compromise, a cloud identity takeover — and make the real decisions responders face, one step at a time, against a ticking incident clock.

Every choice is scored against incident response best practice across the five phases of the IR lifecycle: preparation, detection and analysis, containment, eradication and recovery, and post-incident lessons. Scenarios branch from a persistent world state, so two teams rarely see the same story, and randomized derailments inject the unplanned interruptions that make real incidents messy. Facilitators can host live sessions where the whole room votes on each decision, while solo players train at their own pace and build a track record across a certification path.

It is built for security teams practicing their runbooks, for legal, HR, communications and executive seats who need to rehearse their role in a crisis, and for training providers running client pilots and facilitated workshops. Debrief reports, path comparisons and phase analytics turn each session into measurable, repeatable learning.

IncidentCraft is designed, written and maintained by the IncidentCraft team, who run incident response exercises with real security and business teams and build every scenario from the lessons of those sessions.