A Simulated Breach with Immediate Impact and Teachable Moments

We bring incident response exercises into the real world. Our testing combines elements of the penetration test, tabletop exercise and security awareness training to provide immediate impact and teachable moments. We use experiential learning to help your employees notice what’s above the baseline and ensure they have the tools to respond.

If you’re ISO27001 certified, you need to be testing your incident response and business continuity plans annually. This is normally through tabletop exercises. Whilst valid, this approach can limit the involvement of staff on the ground who would be most likely to detect an incident and make those critical, early decisions. Our unique approach involves your employees in a real-world breach scenario while providing feedback directly to them. All engagements are performed with the aim of learning lessons rather than placing blame.

Our testing typically includes creating a breach. This might be us plugging USB sticks into computers or simply walking around, picking up people’s laptops. Whilst a breach has occurred and we want people to learn from that, we try and ensure there’s a victory for the team on top of the learning points. A positive story is one that spreads, along with the lessons, becoming a force multiplier for cultural change.

This kickstarts the more traditional tabletop exercise, where we can review strategic decision making. Where we can take this to the next level is by involving teams who would be implementing those decisions. Their shop-floor knowledge can help generate better ideas as well as giving those on the ground some insight into what happens and why, breaking down silos and rigid thinking.

Who can benefit?

• Businesses holding personal or sensitive information.
• Companies who may be targeted by activists.
• Financial institutions.
• Schools with upcoming OFSTED inspections or concerns about a risk in the community.
• CNI (hospitals, stadiums, other places within the remit of NPSA / CTSAs).
• Hotels catering to clients who require security and discretion.
• Companies who need to change their security culture.
• Companies covered under the NIS framework.

Uses and Advantages

• Mostly aimed at ISO27001 certified organisations.
• You may require a penetration test as part of your insurance or licencing conditions.
• Insurance premiums can be reduced.
• In the event of a GDPR breach, showing you’re serious about information security can help turn a fine into a corrective measure.
• Auditing the physical and human side of information security as part of the NIS (Network and Information Systems) framework.
• Recruiting your staff to be part of your security infrastructure can greatly increase its efficacy.
• Schools can use variants of these tests to help avoid failing the physical security element of OFSTED’s safeguarding requirements and stay one step ahead of evolving requirements.

If you wish to discuss whether we can help you, please contact us.

Home