Training & Simulation

A scenario built on your organization - your systems, your jurisdiction, your suppliers, your regulator - and run in real time with your people making the decisions. Not a tabletop walkthrough of what should happen, but a situation that develops based on what they actually do.

Three ways in. If you have an incident response plan, we can assess it first and build a simulation designed to test the places it's thin. If you've been through an incident already, we can rebuild it and run it again with what you know now. Or we build from scratch against a threat that's realistic for your sector and your exposure.

What surfaces is usually not technical. It's who waits for authorization that never comes, which decision has no clear owner, what gets escalated too late, and how quickly the plan stops being consulted.

How people are actually targeted: identified, researched, approached, and used as the way in. Built on real technique rather than the phishing-awareness version - pretexting, authority and urgency, channel selection, and why a particular person gets chosen over the one sitting next to them.

Where the engagement calls for it, we can build the session on the organization's own exposure - what's publicly reconstructable about your reporting lines, and who a capable outsider would actually approach. People take the material differently when the example is their own team.

This is training, not testing. Nobody is contacted and nothing is attempted. Authorized simulation is a separate engagement under separate rules.

Why people make the decisions they make under pressure, and why security programs that assume rational actors keep failing. Delivered by a practitioner with master's degrees in clinical psychology and criminology, not adapted from a security curriculum.

Covers how manipulation actually works - compliance, authority, reciprocity, and urgency - alongside the conditions that make people vulnerable to it: fatigue, ambiguity, hierarchy, and the fear of being wrong in front of colleagues. Also the other direction: how offender behavior and motivation shape who gets targeted, and why.

This tends to be the session that changes how leadership thinks about the problem, because it explains behavior their policies have been treating as carelessness.

The training your policy, insurer, or regulator requires - delivered so people retain it. Same coverage a compliance program calls for, built around real cases and current technique rather than a reused deck and a quiz.

If you need the box checked, we'll check it properly. Where there's appetite for more, the same session can be built on your organization's own exposure, which raises the ceiling considerably.

A real incident, taken apart in detail. What the initial access actually was, how it moved, what the defenders saw and when, which decisions helped and which cost time, and where the whole thing could have been stopped.

Sessions can be built on public incidents relevant to your sector, or on something you experienced yourself. Reconstructing your own incident tends to be the more valuable version - the details are already familiar, so the session can spend its time on what went wrong in the response rather than on establishing the facts.