Choose a scenario
After you sign in, you land on Select a scenario. Choosing an exercise takes two steps: pick a scenario, then pick a threat actor.
Scenario types
| Type | What it covers | Plans |
|---|---|---|
| Cyber | Ransomware Attack, Supply Chain Compromise, Insider Threat, Business Email Compromise, Data Breach, DDoS & Extortion | All plans |
| ISO 27035 | Five scenarios that follow the ISO/IEC 27035 incident management lifecycle, each with a difficulty level | All plans |
| Crisis | Fast-moving crises such as kidnap and ransom, extortion, travel security, reputation and media, and fixated-person escalation | Pro and Enterprise |
| Third-Party Resilience | A critical supplier or provider fails | Pro and Enterprise, in some regions. See Third-party resilience |
| Real World Attacks | Scenarios drawn from documented attacks and threat-actor campaigns | Pro and Enterprise |
| Custom | Scenarios you write yourself | Pro and Enterprise. See Custom scenarios |
Step 1: pick a scenario
- Use the filter buttons to narrow the list: All, ISO 27035, Cyber, Crisis, Third-Party Resilience and Custom. You only see the filters your plan and region include.
- Select a scenario card. Each card shows its category, severity and a short description.
- Select Select threat actor.
For a third-party resilience scenario, the button reads Continue to briefing instead, because there is no threat actor to choose.
Step 2: pick a threat actor
The screen changes to Select a threat actor. Each card shows the group’s name, aliases, origin, a description and its MITRE ATT&CK techniques.
- Basic shows a curated set of six: APT29, APT28, APT41, Lazarus Group, FIN7 and Scattered Spider.
- Pro and Enterprise show the full library, including No Specific Threat Actor for a generic attacker.
- For crisis scenarios you choose from fictional adversary profiles instead, and a suggested one is already selected.
Select a card, then select Begin exercise. To go back, select Change scenario.
Real World Attacks
On Pro and Enterprise, select Real World Attacks at the bottom of the Select a scenario screen.
- You see the incidents for your region, then Globally relevant incidents. Incidents tagged only to other regions are not shown.
- Each one has its threat actor already paired, so there is no threat actor step.
- You play a fictional organisation. Where an exercise is based on a single incident, the real organisation is named only to identify it.
Select an incident, then select Begin exercise. The briefing opens. To go back without choosing, select Back.
Other links on this screen
The bottom of Select a scenario also has Settings, History, Real World Attacks, Create scenario and Sign out.