A TTX provides training so that each participant knows exactly what to do in the event of a cyber incident. A TTX consists of simulating known and emerging threats against critical assets and processes in a real-world context where conclusions are documented without disruption to actual assets. These facilitated simulations equip participants with the knowledge to identify and respond effectively to real and potential cyber threats and associated risks.

The TTX is made up of progressively complex scenarios, such as a phishing attempt that leads to a ransomware attack. Each scenario is scripted to be as close to reality as possible, leading to identification of security gaps and vulnerabilities to be addressed. The scenarios are carefully planned to achieve identified goals and learning