Zero Hour
Your team, ready for its worst day.
Zero Hour is a cyber readiness platform. It runs attack tests and incident drills on a copy of your environment, with your SOC, IT, leadership and outside providers, and measures how each of them performs against the clock.
Every exercise measures six things.
Detection
Attack steps prevented and detected, by MITRE ATT&CK technique.
Response time
Minutes from first alert to escalation and containment.
Deadlines
Each regulator and insurer notice, met or missed.
Providers
MDR and incident response times against their contracts.
Recovery
Restore time for each system against its target.
Gaps
Each gap with an owner, a fix and a retest.
For security teams that answer to a board and a regulator.
- Your regulator expects tested incident response and recovery, under rules such as DORA, NIS2 or NYDFS Part 500.
- The board asks how fast you would detect an attack, notify the regulator and restore the business.
- You pay for an MDR service and an incident response retainer, and neither has been timed.
- Your tabletop exercises end in discussion, with no measured result to show.
Not a fit if you need a single penetration test report for an audit. A standard penetration test covers that.
Two modules, one signature exercise, one record.
Attack Testing and Drills each work on their own. The Worst Day runs both at once, and every result goes into the Readiness Record.
Attack Testing
For the SOC and detection engineering
- Threat simulations
- Red team assessments
- Red vs blue exercises
- Purple team sessions
- Security tool and MDR checks
Drills
For the CISO, executives and responders
- Live tabletop exercises
- Regulator clock drills
- Provider drills
- Black Start restore drills
The Worst Day
One major incident from first alert to last restore, with both modules running together.
- Every team on one timeline
- Regulator and insurer clocks
- Restores timed against targets
Readiness Record
Every test and drill, timed and recorded, with after-action reports and a board pack.
- After-action report for every exercise
- Two-page board pack
- Read-only access for auditors
Attack Testing shows every attack step and who caught it.
DeployOpen operators run attacks against the copy of your environment. For each step you see whether it was prevented or detected, who saw it and how long it took.
Mapped to MITRE ATT&CK
Every step carries its technique ID.
Your tools in the test
Your EDR, SIEM rules and MDR provider take part, and the results show which step each one caught.
Retest in place
After a fix, the same path runs again on the same finding. The finding closes when the chain is broken.
Drills put your decision-makers on the clock.
Executives, legal, communications and IT work a live incident from a browser or a phone. Every decision is logged with who made it and when.
Live tabletop exercises
Injects arrive as the incident unfolds: a ransom note, a leak site post, a journalist's email.
Regulator clock drills
Deadlines start when the incident is declared or data theft is confirmed, and each is marked met or missed.
Provider drills
Your MDR provider and incident response firm are timed against the response terms in their contracts.
Black Start restore drills
IT restores from backup while the attacker is still inside, against each system's recovery target.
Notification deadlines your drills can run against
- 4 hDORA initial notificationFrom classification as major
- 24 hNIS2 early warningFrom awareness
- 72 hGDPR breach notificationFrom awareness
- 4 daysSEC incident disclosureBusiness days, from the materiality decision
Your compliance team confirms which deadlines apply to you.
The Worst Day runs a full incident across every team.
Our signature exercise uses both modules at once. The SOC fights the attack on the copy while leadership makes the ransom, disclosure and recovery decisions, all on one shared timeline. It can start from a gap your last attack test found.
How a ransomware Worst Day unfolds
- T+00:00
EDR flags a credential theft tool. The MDR timer starts.
- T+00:27
The MDR provider escalates to the SOC.
Within contract - T+00:51
Major incident declared. DORA and insurer clocks start.
- T+01:51
The ransom demand reaches leadership.
- T+02:16
Data theft confirmed. The GDPR clock starts.
- T+04:26
DORA initial notification sent.
Met, 25 min to spare - T+04:51
The insurer notice passes unsent. Nobody owned it.
Missed - T+09:06
File server restored from the offline copy.
Past its target
Walkthrough, 3 min 26 s, captioned.
Exercises run on a copy of your environment.
DeployOpen builds the copy from your exports: identity, servers, business applications, security tools and backups. Production is never touched.
Tagged by source
Each host shows whether it came from you or from a starter environment.
Your detection stack
Your SIEM and EDR run on the copy with your detection rules loaded.
Known differences
Every difference from production is recorded before an exercise and repeated in each report.
Reset and logged
The copy returns to a clean build after each test, and the cleanup is logged.
One record of every test and drill, ready for your board.
Each test and drill writes a timed entry with its outcomes, decisions and gaps. After-action reports and a two-page board pack come straight from the Readiness Record, and auditors get read-only access.
Start with one Worst Day.
A first engagement gives you a measured baseline across every team, and the first entry in your Readiness Record.
Choose the incident
We agree the scenario and who takes part.
You get the scenario and the participant list
Build the copy
DeployOpen builds the parts of your environment the scenario needs.
You get the environment, checked and ready
Run the day
A DeployOpen operator runs the Worst Day and plays the attacker and the outside parties.
You get the full incident timeline
Debrief
We walk through the results and propose a program of tests and drills to close the gaps.
You get the after-action report, the gap list with owners and a board pack
Book a demo.
We run a ransomware Worst Day on the demo range: the attack, the decisions, the restores and the board pack. Then we plan your first exercise.
Does Zero Hour touch our production systems?
No. Every exercise runs on the copy of your environment, and each report lists the differences from production.
Who runs the exercises?
A DeployOpen operator plans each exercise with you, runs it on the day and plays the attacker and the outside parties, such as the press.
Do our MDR provider and incident response firm have to take part?
Only if they agree. When they take part, their response is timed against the terms in their contracts.
Can we start with one module?
Yes. Attack Testing and Drills each work on their own, and both write to the same Readiness Record.
Does a good result mean we are secure?
No. A result shows what your team did in the exercise. It does not prove that production is secure, and every report says so.
How does Zero Hour relate to CyberGoatz and CyberHire?
All three run on DeployOpen's cyber range. CyberGoatz trains individuals, CyberHire assesses candidates, and Zero Hour tests how your organization performs together in an incident.
