Scenario library
12 scenarios, ready to tailor
Each scenario ships with staged injects, role targeting, artefacts and facilitator notes. Tailor it to the client's environment with AI, fork it into your own library, or author from scratch.
Destructive attack
Ransomware Encryption Event
Endpoint encryption spreads from a finance file share into virtual infrastructure while a ransom note demands payment within 48 hours. Backups are partially validated.
Pressure-tests
- Containment authority
- Ransom payment stance
- Backup confidence
- Customer notification
90–120 min · Executive + technical
Fraud
Business Email Compromise
A spoofed executive thread pushes a same-day wire to a new supplier account. Finance has already released the first payment when the exercise opens.
Pressure-tests
- Payment controls
- Escalation path
- Legal recovery options
- Insurer engagement
60–90 min · Executive + finance
Insider threat
Malicious Insider
A departing engineer bulk-downloads source code and customer records. HR, legal, and security must coordinate evidence handling without tipping off the individual.
Pressure-tests
- Evidence preservation
- HR/legal coordination
- Access revocation
- Privilege boundaries
75–90 min · Executive + HR + legal
Supply chain
Third-Party / Vendor Compromise
A managed IT provider discloses a breach of the remote access tooling it uses across your estate. Scope is unknown and the vendor is slow to answer.
Pressure-tests
- Contractual leverage
- Compensating controls
- Concentration risk
- Client communications
75–90 min · Executive + vendor management
Identity
Cloud Identity Takeover
MFA fatigue attacks land on a privileged administrator. Conditional access logs show new tenant apps consented and mail rules created.
Pressure-tests
- Privileged access recovery
- Token revocation
- Tenant hardening
- Forensic scope
60–90 min · Technical
Extortion
Data Extortion Without Encryption
An actor posts a sample of regulated customer data on a leak site and sets a countdown. Nothing is encrypted, so operations continue as normal.
Pressure-tests
- Regulatory clocks
- Public messaging
- Negotiation posture
- Board reporting
75–90 min · Executive + comms
Operational technology
OT / Manufacturing Disruption
A plant historian and two HMIs go offline mid-shift. Engineering suspects a network segmentation failure between IT and OT.
Pressure-tests
- Safety-first decisions
- IT/OT boundaries
- Production trade-offs
- Recovery sequencing
90 min · Executive + plant ops
Availability
DDoS and Availability Extortion
Customer-facing services degrade under a volumetric attack while an actor demands payment to stop. Status page traffic spikes.
Pressure-tests
- Mitigation escalation
- Customer status comms
- SLA exposure
- Provider coordination
60 min · Technical + comms
Corporate event
M&A Diligence Breach
During a live acquisition, the target discloses a historic breach that was never reported. Deal timelines and disclosure duties collide.
Pressure-tests
- Deal risk decisions
- Disclosure duties
- Integration controls
- Board escalation
75 min · Executive + legal
Emerging risk
AI Assistant Data Leak
An internally deployed AI assistant is found summarising documents from a restricted legal matter to the wrong audience.
Pressure-tests
- AI governance
- Access model review
- Privilege containment
- Policy response
60 min · Executive + technical
Physical
Physical Intrusion to Network Access
Badge logs and camera footage suggest an unauthorised visitor connected a device in a branch office comms room.
Pressure-tests
- Physical/cyber handoff
- Evidence chain
- Branch isolation
- Law-enforcement engagement
60 min · Executive + facilities
Compliance
Regulatory Inquiry Follow-Up
Six weeks after an incident, a regulator requests records, timelines, and evidence of remediation with a short response window.
Pressure-tests
- Records readiness
- Timeline accuracy
- Remediation evidence
- Spokesperson discipline
60 min · Executive + legal + compliance
Need a scenario that matches a specific threat model?
Bring the environment, the sector and the concern. We will show you how tailoring works on a live exercise.