Custom Tabletop Exercises For Crisis Simulation

Experience a business crisis,
not just a SOC event

Navigate a rapidly escalating corporate threat landscape. Scroll to advance through the live timeline injections and observe how cross-functional containment models adapt under fire.

Set the Scene

Align on the threats, stakeholders, and business risks that matter most to your organization to produce a tailored scenario aligned to your objectives.

Something's Not Right

A cyber crisis unfolds through breaking news, stakeholder communications, media scrutiny, and timed injects.

Teams are immersed in a realistic, evolving incident from the very first decision.

Under Pressure

Executives face business disruption, legal implications, regulatory scrutiny, and competing priorities while responders work to understand what is happening.

A realistic test of decision-making, escalation, communication, and crisis leadership.

A second set of eyes

Legal, communications, risk, and other stakeholders join the discussion. Executives are asked to weigh in, challenge assumptions, give feedback, and acknowledge emerging risks as new information arrives.

Tests stakeholder alignment, decision ownership, and cross-functional coordination under pressure.

Follow the Breadcrumbs

New intelligence, technical findings, and conflicting information emerge as the investigation progresses.

Teams learn to balance business impact with technical reality and uncertainty.

Raise the Stakes

Customer impact, executive pressure, media attention, third parties, and regulators introduce new challenges and force critical decisions.

Clear visibility into how your organization collaborates when the pressure is highest.

Debrief & Analysis

Review key decisions, missed opportunities, communication breakdowns, and response strengths with HTB facilitators.

A Golden Report and actionable roadmap to strengthen resilience, readiness, and workforce capability.

Anglerfish Anomaly

APT: Cuttlefish Malware

Anglerfish Anomaly

APT: Cuttlefish Malware

A recent threat intelligence report has highlighted a new, sophisticated malware variant, "Anglerfish" (emulating Cuttlefish/HiatusRAT capabilities), specifically targeting SOHO routers to steal credentials, redirect traffic, and establish covert proxies. While the initial infection vector is currently unknown, the malware is designed to operate stealthily, persist in memory, and manipulate network traffic at the router level.

Operation Ghost in the Machine

APT: APT33

Operation Ghost in the Machine

APT: APT33

Recent intelligence advisories have highlighted a sharp uptick in activity from APT33 (AKA Elfin, HOLMIUM, Peach Sandstorm), a well-documented, nation-state-aligned threat group. Historically focused on espionage, APT33 has recently demonstrated a dangerous shift towards disruptive and destructive capabilities, particularly against operational technology (OT) and critical infrastructure operators.

Scattered Wealth

APT: Scattered Spider

Scattered Wealth

APT: Scattered Spider

Recent intelligence advisories, including a critical alert from Google's Threat Intelligence Group (June 2025), have highlighted a significant expansion in activity from Scattered Spider, a notorious group of young, English-speaking cybercriminals. Their primary method of breaching networks involves sophisticated social engineering tactics, particularly impersonating employees to trick IT help desk staff into resetting passwords or bypassing Multi-Factor Authentication (MFA).

Operation Snowfall

APT: Snowflake Breach

Operation Snowfall

APT: Snowflake Breach

Recent intelligence indicates that a financially motivated threat group, "GlimmerHunters" (emulating ShinyHunters capabilities), has been actively targeting cloud data warehousing environments like DataVault's. This group specializes in gaining unauthorized access to cloud storage accounts, exfiltrating sensitive client data, and then extorting ransoms in exchange for deleting the stolen data.