Adversary X runs AI-driven tabletop exercises for the teams who keep the business running: cyber attacks by real threat actors, critical supplier failures and operational crises, with your region's regulatory context built in and a scored report to evidence how you responded.
Forensic analysis confirms the attacker deployed SUNBURST-variant malware via the SolarWinds Orion update pipeline. Lateral movement is confirmed across 4 domain controllers. EDR telemetry shows T1078 (Valid Accounts) and T1021.002 (SMB Remote Services) activity.
Resilience is owned by more than the security team. Adversary X gives each of them an exercise that tests the decisions they would actually have to make.
Each type runs through its own response phases, so the exercise follows how that kind of disruption actually unfolds.
Ransomware, business email compromise, insider threat, data breach, DDoS and supply chain compromise, driven by a named threat actor and its real techniques.
A critical supplier fails and your team has to keep important services running, meet its notification duties and manage the supplier through to recovery.
Fast-moving crises where verification, communication and a few hard decisions matter more than technical response.
Exercises structured on the ISO/IEC 27035 incident management lifecycle, for teams that run their process to the standard.
Get a guided walkthrough with a member of our team. We'll show you how the platform works, walk through a live exercise, and answer any questions about fit for your organisation.
From the first alert to the post-incident debrief, Adversary X puts your team through a complete response cycle with AI-driven consequences at every turn.
Each scenario draws on a documented incident or threat-actor campaign, from ransomware at a critical supplier to a software supply chain backdoor. The timeline is real. Your team's decisions are the variable.
Scenarios are based on publicly reported information. Canary Zero Ltd has no affiliation with the organisations named and does not claim access to non-public incident details.
Regulators expect you to test your response to severe but plausible disruption, and to show what you found. Adversary X helps you run those exercises and keep the record. It does not, on its own, make you compliant.
Framework summaries paraphrase the published requirements for orientation only. They are not legal advice.
Most tabletop exercises are a static scenario, a facilitator and a slide deck. Adversary X gives you a living exercise that adapts to every decision your team makes, whether the disruption starts with an attacker or a supplier.
| Capability | Adversary X | Typical alternatives |
|---|---|---|
| AI-driven scenario engine that adapts to your decisions | ✓ | Limited |
| Third-party and supply chain failure scenarios, not just cyber attacks | ✓ | Limited |
| Named APT profiles with full MITRE ATT&CK TTP mapping | ✓ | ✗ |
| 13-region coverage: UK, EU, US, Canada, APAC, Middle East & more | ✓ | ✗ |
| Region-aware regulatory context per exercise (DORA, UK operational resilience, CPS 230, NIS2, GDPR, VARA…) | ✓ | ✗ |
| Scenarios drawn from real attacks and threat-actor campaigns | ✓ | ✗ |
| Scored debrief with strengths and improvement areas | ✓ | Limited |
| Downloadable PDF report per exercise | ✓ | ✗ |
| No facilitator or pre-configuration required | ✓ | ✗ |
| Runs in-browser, no software install | ✓ | Limited |
| Ready to run in under 5 minutes | ✓ | ✗ |
| Flat annual pricing, no per-session or per-seat fees | ✓ | ✗ |
Every plan is quoted for your organisation. Book a demo and we'll talk it through.
Run cyber, third-party and crisis exercises for your clients from your own branded portal, manage every client organisation in one place, and report across your portfolio.
Everything you need to know before getting started.
Adversary X is an AI-powered tabletop exercise platform for the teams responsible for cyber, operational and third-party resilience. It simulates realistic disruptions, from ransomware and supply chain attacks to critical supplier failures and crises, and puts your team through a structured, scored decision-making process. Every exercise ends with a scored debrief and a downloadable PDF report.
Adversary X is built for heads of operational resilience, third-party and supplier risk managers, business continuity and crisis managers, CISOs and incident response teams, and the compliance leads who need evidence that plans have been tested. It works equally well for technical and non-technical participants: the platform provides all the context needed to make meaningful decisions.
No. Alongside cyber incident response, Adversary X runs third-party resilience exercises (a critical supplier fails, a cloud provider goes down, a supplier is sanctioned) and crisis exercises. Third-party resilience scenarios are available on Pro and Enterprise for the UK region today, with more regions planned.
It helps you run and evidence scenario-based exercises: each one tests how your team responds to a severe but plausible disruption, records every decision, and produces a scored report you can share with leadership, auditors and regulators. It does not by itself make you compliant with DORA, the UK operational resilience rules or any other regulation; it is one part of your testing programme.
Most exercises take between 20 and 45 minutes to complete, including the scored debrief. Setup takes under 5 minutes: you choose your scenario, threat actor where relevant, severity level, and organisation type, then you're straight into the exercise. There's no scheduling, no facilitator needed, and no minimum group size.
The platform adapts regulatory context to your region, including DORA in the EU, UK operational resilience (PRA and FCA) alongside ICO, NCSC and NIS obligations, APRA CPS 230 in Australia, NIS2, and VARA and other GCC frameworks. In every case, the debrief explicitly identifies which obligations your decisions triggered and whether they were handled correctly.
Each APT profile is based on documented threat intelligence and MITRE ATT&CK mappings. The library includes nation-state groups (APT28, APT29, Lazarus Group, Volt Typhoon), financially motivated actors (LockBit, Cl0p, BlackCat/ALPHV), and opportunistic groups (Scattered Spider, Rhysida). The AI uses each group's known TTPs to drive the scenario narrative, so the attack chain feels authentic, not generic.
Basic gives you access to 6 APT profiles, 11 built-in cyber and ISO 27035 scenarios, scoring, and a basic PDF report. Pro adds the full library of 19 APT profiles, the Real World Attacks library of 38 scenarios, crisis scenarios, third-party resilience scenarios (UK region), mid-exercise injects, a custom scenario builder, exercise history, and enhanced PDF reports.
Exercise responses and scoring data are stored securely and associated with your account only. We do not use your exercise data to train AI models. Data is processed in accordance with our Privacy Policy and applicable data protection obligations. Enterprise customers can discuss data residency and retention requirements during onboarding.
Book a demo and we'll walk you through a live exercise.
Book a demo