Custom scenarios

On Pro and Enterprise you can write your own scenarios and run them like any built-in cyber scenario. On Basic, the builder shows “The custom scenario builder is a Pro feature”.

Create a scenario

On Select a scenario, select Create scenario at the bottom of the screen. If the Custom filter is empty, you can also select Create a scenario there.
On Create custom scenario, fill in the fields below.
Select Create scenario.

You return to Select a scenario. Your scenario appears under the Custom filter with a Custom tag.

The fields

Field	Required	Notes
Scenario title	Yes	A short name shown on the scenario card, up to 80 characters.
Category	Yes	For example MALWARE, RANSOMWARE, SOCIAL ENG., INSIDER THREAT, SUPPLY CHAIN, OT/ICS or ISO27035.
Severity	Yes	LOW, MEDIUM, HIGH or CRITICAL. MEDIUM is selected unless you change it.
Short description	Yes	One or two sentences shown on the card, up to 220 characters. Describe the initial incident.
Scenario context	Optional but recommended	Up to 2,000 characters for the AI: sector, size, systems, regulatory environment, location and anything else you want reflected.
Target environment	Optional	Five fields: Key third parties / suppliers, Cloud platform(s), Identity provider, Key systems / infrastructure and Security controls. The AI builds the scenario around what you list.
MITRE ATT&CK tactics	Optional	Select the tactics to emphasise. If you select none, the AI uses the chosen threat actor’s usual tradecraft. Clear all removes your selection.

Do not enter real secrets, passwords or personal data about real people. Describe systems and suppliers at the level you would put in a briefing pack.

Run a custom scenario

Select it on Select a scenario, select Select threat actor, choose a threat actor, then select Begin exercise.

Edit or delete a custom scenario

Each custom scenario card has two buttons:

Edit opens the scenario. Make your changes and select Save changes.
Delete asks you to confirm. Select Delete again to remove it. This cannot be undone.