IR Now
How it works

From zero to ready,
without the consulting bill

Module by module, team by team, scenario by scenario — how IR Now builds an incident response program tailored to your organization.

The build

Four steps, then it exists

You answer questions about your organization. Everything after that is generated, reviewed by you, and live the next day.

Tell us about your organization

A guided profile — 37 fields covering your industry, stack, identity provider, compliance posture and team. Every field shapes the modules that follow.

  • Industry, team size, and the systems you actually run
  • Frameworks you report against (SOC 2, ISO 27001, PCI DSS)
  • Playbook references and on-call patterns
Organization profile · IR context · 37 fields
Organization profile28 / 37
Financial technology
51–200
AWS
SOC 2ISO 27001PCI DSS
What it looks like

Worked through, not watched

Learners step through cards at their own pace. The clock only appears in the final quiz. Admins watch it land in real time.

Workspace/Dashboard
Active learners
412
▲ 8%vs prev
Completion
87%
▲ 4%vs prev
Overdue
9
▼ 12%vs prev
Avg quiz score
78%
▲ 3%vs prev
Active coursesMost urgent first
Ransomware readiness — Engineering
PRO · 9 modules · 12 Aug 2026Engineering
On track
148/160 completed93%
81%
AVG SCORE
Data breach response — Legal & Comms
PRO · 7 modules · 04 Aug 2026Legal
6 overdue
31/48 completed65%
72%
AVG SCORE

Illustrative product preview.

Coverage

Fourteen scenarios. Every plan.

Not a menu you upgrade into. Tap any scenario to see what your team practices, and which roles it reaches.

Every scenario module follows the same deep structure: detection signals → response priorities → your org's context → team scenario → role-specific actions → tool-specific steps.
Someone is inside
Data is exposed
People are the vector
Infrastructure is failing
Someone else's problem, now yours
Every learner also works throughWhat it isWhy it mattersDetection signalsResponse prioritiesYour org's contextTeam scenarioRole-specific actionsTool-specific stepsKey takeaways
Built for every team

Ten roles. One per course.

Each Pro course targets a single team and generates that team's module, shaped by their headcount, technical literacy and the tools they actually use.

Security TeamLeads the response
Software EngineeringDefends the code they ship
IT & InfrastructureIsolates and recovers systems
Leadership & ExecOwns the high-stakes calls
Legal & ComplianceObligations & privilege
Finance & AccountingFraud, insurance & reporting
HR & People OpsInsider risk & sensitive data
Customer SupportThe customer-facing voice
Marketing & CommsOwns the public voice
Operations & FacilitiesThe physical & human layer
Set expectations

What IR Now is — and isn't

IR Now is

  • Grounded in expert IR frameworks, tailored to your real systems and playbooks
  • Scenario-based, testing real decision-making
  • Continuously updated as threats evolve
  • Fast to deploy, live in hours, not weeks

IR Now isn't

  • Generic, off-the-shelf compliance training
  • A penetration testing or vulnerability scanning tool
  • A SIEM, detection, or monitoring tool
  • A one-time, set-and-forget course

See it built for your stack.

Request access and we'll generate a course from your organization's real profile.