Adaptive crisis simulations that replace static incident response tabletop exercises

The complaint Reflex Security is built around is that most tabletop exercises amount to a slide deck and a facilitator reading injects from a script. Nobody is surprised, nobody is under pressure, and the gaps that surface in a real breach, which are usually coordination and communication rather than technical, never appear. Reflex generates the scenario from the organization's actual environment, drawing on the tools it really runs such as AWS, GitHub, and Cloudflare, and then plays the incident out as a live simulation. An AI facilitator joins the call, and the adversary responds to what the team does instead of following a fixed timeline.

The simulation also populates the roles that make an incident hard. Journalists ask for comment, regulators ask for notification timelines, executives ask questions the incident commander cannot yet answer, and each of them reacts to what the team says. That pulls legal, communications, and leadership into the exercise alongside the security function. When the run ends, the platform produces an after-action report automatically, with findings traced back to the moment in the exercise where they occurred, plus a per-participant skills assessment. The company was founded in 2026 in the United States and has not published funding details. It should not be confused with the earlier network security firm of the same name.