Live, role-based scenarios that generate a real After-Action Report — the kind of exercise consultants usually charge $10k-40k to facilitate.
Ransomware has hit the production network of a major manufacturing plant, causing physical safety shutdown loops and threatening lateral propagation to adjacent sites.
A senior platform engineer submitted his two-weeks notice yesterday afternoon. Overnight, DLP tooling flagged an unusual bulk clone of the proprietary risk-scoring codebase and an attempted export of a customer PII table, both from his account, outside business hours.
At 11:40 PM, an IT helpdesk analyst receives an urgent call from someone claiming to be the CFO, locked out of his account before an early-morning board call. Under pressure, the analyst resets MFA and registers a new device. Within the hour, SOC flags an anomalous login to the CFO's account from an unrecognized device and location.