Runs structured cybersecurity tabletop exercises aligned to HSEEP methodology and NIST SP 800-61r2. Designed for Tom to facilitate over Zoom — he drives the exercise on his screen while participants watch and discuss. All data is saved locally in your browser.
Each client organization gets its own saved exercise state. Use the client dropdown in the nav to switch between clients or create a new one. Nothing is shared between clients.
Everything stays in your browser's localStorage — no data is sent to any server during a local session. Use Export JSON to back up or transfer an exercise to another device.
Click + New Client in the nav. Enter the organization name, facilitator name, and exercise date. A new saved state is created automatically.
Use the Name / Role grid in Setup to list everyone in the room. Each row is one person. Click + Add Participant to add rows. This list appears in the after-action PDF.
Select one of the 8 built-in scenarios or use the AI generator. Scenarios marked TRA-UNIQUE — the DFARS/CUI Breach and C-TPAT Supply Chain Infiltration — are exclusive to TRA and not available in any other free tool.
If you have run a scenario with this client before, use Refresh Scenario on the Scenario Brief screen. Claude rewrites all inject narratives and discussion questions while keeping the same structure — the client gets a fresh experience without repeating content.
Select the AI-Generated Scenario option in Setup. Fill in sector, size, key systems, CUI handling, cross-border operations, IR maturity, and difficulty. Requires a Claude API key (BYOK — stored in your browser only, never in this file). Generation takes about 20–30 seconds.
Each inject shows a situation update and discussion questions. Read the situation aloud, then let the team discuss. Capture what they say in the Facilitator Notes panel. Use Next to advance when the discussion is done.
Notes are saved automatically as you type. Click Expand in the notes panel header to open a larger writing surface as a modal — useful for capturing detailed responses. Notes are per-inject and carry through to the after-action report.
Three flag chips at the bottom of each inject track legal and compliance obligations that arise during the scenario. Click a chip to enable it when that obligation is triggered; click again to disable if the team walks it back.
All triggered flags appear in the after-action report with a record of what was and was not activated during the exercise.
The timer in the notes panel is optional and off by default. Use it to pace discussion time per inject. It does not auto-advance — you stay in control. Keyboard shortcut: T to start/pause, R to reset.
Use Prev / Next buttons or keyboard shortcuts to move between injects. The inject counter shows your position ("1 of 7 — Phase 1 of 3") at all times. When you reach the last inject, Next becomes After-Action.
Lets participants follow along on their own devices while Tom drives from his screen. Participants see the current inject update in real time — they have no controls and cannot peek ahead. Requires the TRA backend at traconsulting.mx/api/.
A green session banner appears at the top of the exercise screen showing the session token, the participant URL, and how many people are connected. As you advance injects, participant screens update within a few seconds.
Use Hide Questions / Show Questions in the session banner to control whether discussion questions appear on participant screens. Hiding lets you reveal them verbally and control the pace of discussion.
Click End Session in the banner. Participants see an "Exercise Complete" screen. Your notes and after-action report remain intact — ending the session does not delete any data.
The tool works fully in local mode without a backend connection. All notes, PDF export, and JSON export continue to function normally. Remote Session simply won't be available until the backend is reachable.
Available once you reach the After-Action screen. Compiles all facilitator notes organized by phase and inject, lists which regulatory flags were triggered, identifies common gaps for the scenario based on TRA field experience, and suggests next steps with links to relevant TRA compliance tools.
Click Generate PDF Report on the After-Action screen. A print-ready version opens in a new window with TRA branding and Tom's contact information. Use your browser's Print → Save as PDF to save it. The report is designed to be handed directly to the client.
Use Export JSON in the nav to download a complete snapshot of the exercise state — setup, notes, flags, and all. Use Import JSON to restore it on any device. This is the recommended way to back up a completed exercise before clearing browser data.
The after-action report automatically suggests relevant TRA compliance tools based on the scenario type — for example, a DFARS/CUI scenario links to the NIST 800-171 and CMMC tools; a C-TPAT scenario links to the C-TPAT Assessment; an AI Deepfake scenario links to the COMPASS AI Governance Assessment.
Active during the Exercise screen only. Shortcuts are disabled when typing in a text field or notes panel.