BREACH
A cyber security breach simulation
“Most breaches start with one ordinary person. Today it could be you.”
It is quarter-end week at a busy company and something is about to go wrong. You pick the role closest to your real job, from the help desk and finance to the security team, the CISO and the board, and you see only what that job would let you see.
See what BREACH feels like
Transcript of the BREACH intro video Captions are part of the video
It is quarter-end week at a busy company and something is about to go wrong. You pick the role closest to your real job, from the help desk and finance to the security team, the CISO and the board, and you see only what that job would let you see. AI colleagues play everyone else.
The experienceYou see only what your role would let you see: your inbox, your calls, your alerts and what colleagues tell you. A fake email, a convincing phone call or a trusted vendor opens the door, and what happens next depends on everyone, including you.
Each phase brings a few decisions: report it or delete it, verify the caller or reset the password, wake the chief information security officer (CISO) or wait for Monday, cut the network or keep the business running, pay the ransom or rebuild, speak to the press or say nothing. Some ask you to write a short note. When the war room meets, people hold facts they will not mention unless you ask.
AI colleagues play everyone else at the maturity your instructor picks, so you may have to catch their mistakes. The debrief puts the attacker's timeline next to the company's, names the moments that mattered most in your seat, and shows what a different choice would have changed.
- Most breaches start with an ordinary person and an ordinary request. Reporting early beats being right.
- Check requests for money, access and data on a channel you already trust, never the one that asked.
- Containment has to close every door at once. Half-measures warn attackers without removing them.
- Legal clocks, insurers and the press run in parallel with the technical response. Leaders have to run all of them.
- Blaming the person who clicked teaches everyone to hide the next click.
- A phishing test measures one click. BREACH measures what people do across a whole breach: who reports, who verifies, who escalates, how fast, and what leaders decide when the business is on the line.
- Every seat is graded fairly: a help desk agent cannot stop a breach alone, so the score measures how much of the difference their own seat could make.
- A company sees its readiness by role and department, with small groups protected for privacy, and a printable record of the exercise to share with its auditors and cyber insurer.
- Students in information systems, risk and governance courses see a breach from fifteen seats, and leave knowing what each one owes the others.
- Company and role
- Any one of fifteen roles at a fictional company: frontline staff (finance, help desk, HR, executive assistant, any employee), technical teams (security operations, IT infrastructure, cloud) or leadership (CISO, CIO, CEO, CFO, General Counsel, Communications, a board member). AI colleagues play every other seat
- Discipline
- Cyber security and crisis leadership
- Also fits courses in
- Information systems, risk management, corporate governance, business continuity, corporate security training
- Format
- Solo, team (2 to 15 people share one company, AI fills empty seats) or an instructor-run tabletop. Six phases, from a normal working day to recovery, with up to six attack scenarios, five industries, three levels of attacker skill and three levels of AI colleague maturity
- Time
- About 45 to 60 minutes solo, 60 to 90 minutes for a team or tabletop with the debrief
- Advisers and AI
- AI colleagues make their own calls by fixed rules, some good and some not, and answer questions in chat. The AI only writes what they say, and every reply is checked against the facts of the game. The attack and the grade are computed, never written by AI
- How you are scored
- A to F. 60 percent role behavior: how well you played your own seat across about fifteen decisions. 40 percent company outcome: how much better the company did because of you, compared with the same world if your seat had done nothing
- Teaching materials
- Player guide, instructor guide with the hidden attack timeline, how the grade is built and a timed debrief plan, a debrief deck, and a console with live roster, surprise events, readiness by role and department, and a printable exercise record. After the game, each player sees the moments that cost the most, with a better answer and why, what they got right, and a replay of the roads not taken
- Audience
- Companies training staff and leaders, executive education, and university courses. No security background needed for frontline roles
BREACH comes ready to run in class
Player guide
Instructor guide with the hidden attack timeline and a timed debrief plan
Debrief deck
Live roster and surprise events for a tabletop
Readiness by role and department, small groups protected
A printable record of each exercise
Six attack scenarios across five industries
Solo, team or instructor-run tabletop
Bring BREACH to your classroom
You can check out online in a few minutes. For a campus or a big group, just ask us for a quote.