Make good habits familiar.
Rehearse verifying evidence, escalating concerns and involving the right people in a safe, fictional crisis.
ReFlex
Train. Repeat. Improve.
Readiness is built
through practice.
Turn crisis decisions into team muscle memory.
REFLEX / IN FOCUS01:03
TRAIN. REPEAT. IMPROVE.CYBER FITNESS, TOGETHER.
PRACTISE TOGETHER. RESPOND BETTER.
Flex your response muscles.
Put your team through a realistic crisis exercise.
With ReFlex, your team makes the calls, sees the consequences and learns together—building the muscle memory for a stronger response.
BEYOND THE SLIDE DECK
A crisis does not follow slides.
Your exercise should go further, too.
Traditional presentation tools have long supported tabletop exercises. But a slide-led format can make it difficult to capture everyone’s decisions, show their consequences and maintain a shared picture as the crisis unfolds.
ReFlex moves the exercise beyond the presentation. A full crisis simulation suite brings evolving briefings, participant responses, live indicators and guided reflection into one connected experience. Teams make the calls, see the simulated impact and work through what comes next—together.
Turn discussion into decisions. Turn practice into readiness.
Build cyber fitness and response muscle memory through repeatable, engaging exercises that put cooperation into practice.
CYBER FITNESS THROUGH PRACTICE
A playbook describes the response.
An exercise lets your team practise it.
Build shared muscle memory.
Explore how leadership, security and operations weigh competing priorities. Return to the handoffs that need practice.
Leave with practical actions.
Use the decisions and discussion to identify gaps, clarify ownership and agree what to test next.
THE REFLEX EXPERIENCE
Every decision leaves a trace.
A facilitator guides the story. Everyone brings a perspective. The dashboard makes the consequences visible.
- Read the situationWritten facts set the scene. Selected scenarios add video briefings.
- Choose a responseVote on the next move and weigh the trade-offs.
- See the impactFollow changing indicators and the exercise trajectory.
- Pause and discussCompare perspectives and question the assumptions behind the decision.
A CRISIS THAT UNFOLDS
New facts.
New decisions.
Injects appear above the situation room, keeping the team focused on the information that matters. The live dashboard remains the shared reference throughout the exercise.
EVERY VOICE COUNTS
Make the call.
Then explore why.
Response choices bring competing priorities into the conversation. Review the combined response, watch its effect and discuss what evidence could change the decision.
In a self-paced demo, four scripted colleagues vote alongside the visitor. A facilitated exercise brings your real team into the discussion.
FACILITATED TEAM EXERCISES
Practise across roles.
Use the scenario notes and running order to lead a focused session for executives, security teams, operations, communications and other business functions.
- Choose a relevant sector and difficulty.
- Explore ownership, escalation and cooperation.
- Reflect on decisions and agree practical follow-up.
EXPLORE BEFORE YOU EXERCISE
Try a self-paced demo.
Give customers a way to experience the scenario and dashboard before their workshop. Use what they learn to fine-tune the injects, decisions and flow for their audience.
- Explore the story at your own pace.
- Review the suitability of the decisions.
- Prepare a tailored exercise with your facilitator.
LOOK INSIDE AN EXERCISE
One crisis. Ten decisions.
A room full of perspectives.
Explore ZERO HOUR’s timeline, weighted priorities and learning outcomes.
THE SCENARIO PORTFOLIO
20 scenarios. Different challenges.
Choose a setting that reflects your team’s responsibilities. Each facilitated exercise combines an evolving crisis, shared decisions and discussion. Compare the focus, group size and estimated duration below.
Scenario & focusSectorDifficulty
ZERO HOUR — The Friday Cut-off
A fictional Friday cyber crisis at Fortuna Bank. The central question is whether payments and recovery evidence can be trusted, while employers and vulnerable customers cannot wait for perfect information.
- Participants
- 6–50
- Duration
- 105 min
LINE DOWN — OT Manufacturing Crisis
A fictional European precision-components plant faces a compromised supplier access path, ransomware on enabling IT, unreliable HMI visibility and uncertain control integrity.
- Participants
- 6–50
- Duration
- 90 min
CRITICAL RESULTS — Healthcare Under Pressure
An overnight cyber incident at a shared pathology provider disrupts three hospitals just as the morning schedule begins. Results cannot be assumed current, alternate laboratories have limited capacity, and the network must protect care without improvising clinical procedures.
- Participants
- 6–50
- Duration
- 90 min
DARK SIGNAL — Energy Network Crisis
A regional electricity distributor loses confidence in part of its remote visibility during a busy evening. A cyber alert overlaps with a localized weather fault. Operators must separate facts from stale telemetry, coordinate field crews and authorize recovery without allowing commercial urgency to override electrical safety.
- Participants
- 6–50
- Duration
- 90 min
EMPTY CART — Retail & Fulfilment Crisis
On the morning of a major promotion, a suspicious service-desk account reset precedes disruption to Northstar’s order and warehouse systems. Stores can still serve some customers, but inventory, collection promises and carrier handovers are becoming unreliable. Leaders must decide what to sell, fulfil, refund and reopen.
- Participants
- 6–50
- Duration
- 90 min
BORROWED TRUST — APT & Supply Chain
A targeted phishing message from a compromised supplier contact installs an implant on a Meridian Research Group workstation. Weeks later, investigators discover foldering: the implant and its operators exchange instructions and responses through unsent mailbox drafts. The incident threatens confidential research and trusted partner access, while ordinary sent-mail searches miss the command channel.
- Participants
- 6–50
- Duration
- 90 min
HELPFUL AGENT — AI Trust Crisis
Aster Services has connected its support assistant to a knowledge base and customer-service tools. Malicious instructions in a supplier document cause it to expose restricted contract information and recommend unauthorized credits. The team must separate model behavior from failed authorization, protect customers and decide which capabilities can safely return.
- Participants
- 6–50
- Duration
- 90 min
HOUR OF DECISION — Executive Crisis Council
At fictional Halcyon Group, a disruptive cyber incident stops customer services and payroll preparation. The executive team has limited cash, conflicting recovery estimates and an unverified extortion claim. Leaders must establish authority, protect essential commitments and explain what they know. Technical specialists provide plain-language briefs; no configuration or forensic expertise is required.
- Participants
- 6–50
- Duration
- 75 min
OPEN DOORS — Public Services Under Pressure
Fictional Eastmere Council loses access to its citizen portal during a benefits application deadline. The provider confirms a traffic flood, while online claims allege a data leak. Service managers must preserve fair access, coordinate suppliers and recover without losing applications.
- Participants
- 6–50
- Duration
- 90 min
CARGO HOLD — Logistics Trust Crisis
At fictional Harborline Logistics, a compromised freight partner account sends altered collection instructions during a busy dispatch window. Loads are delayed, a high-value consignment is disputed and the team must restore trusted release decisions across carriers, warehouses and customers.
- Participants
- 6–50
- Duration
- 90 min
LONG SHADOW — A Multi-customer Recovery Crisis
Fictional Northline Managed Services faces a compromised shared deployment service during a Friday maintenance window. A multi-day crisis spans customer prioritization, extortion claims, partner access, unreliable restores and an exhausted response team. Each phase adds evidence or a business constraint; leaders must revisit earlier commitments. All times are fictional time jumps.
- Participants
- 6–50
- Duration
- 210 min
QUIET ACCESS — The Intruder Who Logged In
A routine support login at Meridian Industrial Services exposes a hidden intrusion across identities, remote administration and recovery infrastructure. The team must act on incomplete evidence, protect a four-hour continuity window and prove that reopening will not restore the attacker’s access.
- Participants
- 6–50
- Duration
- 120 min
SELECTIVE SIGNAL — The Update That Chose Its Targets
A supplier advisory interrupts a customer launch at fictional Lumen Trade Services. An everyday desktop application has delivered an implant to a subset of endpoints. The team must map exposure, protect privileged access and restore trusted workstations while explaining what the evidence does—and does not—show.
- Participants
- 6–50
- Duration
- 105 min
SCHOOL’S OUT — A Trusted Account Before the First Bell
At fictional Rowanbridge School in Northern Ireland, an invitation to try an AI teaching assistant arrives from a familiar contact. A colleague signs in. Before the first bell, their account sends unexpected messages. Protect pupil information, keep learning moving and maintain trust as the facts emerge.
- Participants
- From 6
- Duration
- 45 min
OPEN SECRET — The Data Nobody Can Account For
At fictional Meridian Bank, a journalist sends a spreadsheet from a public Telegram channel. Some records match customers; several other banks are named. Investigate the source while protecting customers from fraud and communicating what is actually known.
- Participants
- 6–50
- Duration
- 75 min
SANDBOX — When Test Data Becomes a Real Breach
Fictional payment provider RelayPay appears on an extortion site before a busy trading period. Payments still process, but an old migration environment may contain real customer records. Establish the scope, protect service continuity and explain a breach that production availability alone cannot rule out.
- Participants
- 6–50
- Duration
- 75 min
BLACK CASCADE — When Shared Trust Fails
A fictional cross-sector energy crisis connects an upstream producer, a pipeline operator and a refinery. Practise coordination, supplier access decisions, operational assurance, public communication and recovery across shared dependencies.
- Participants
- 6–50
- Duration
- 60 min
PROBESTERBEN — The Company That Couldn’t Stop
A fictional German precision manufacturer confronts a ransomware incident across a compressed three-day story. Teams balance delegated authority, verified production, customer commitments, workforce trust, liquidity and recovery assurance. A functioning machine is not proof that a business can safely deliver.
- Participants
- 6–50
- Duration
- 60 min
LOW PRESSURE — Water Under Uncertainty
Westhaven Water faces suspicious maintenance access, conflicting tank readings and a public contamination claim. Coordinate field checks, sustain essential service and decide what can be communicated—and what evidence must authorize recovery.
- Participants
- 6–50
- Duration
- 90 min
ORBITAL WINDOW — Ground Control Under Pressure
Aster Reach discovers an unapproved ground-system configuration before a contracted satellite service window. Protect command authority, allocate limited fallback capacity and verify recovery while customers need reliable answers.
- Participants
- 6–50
- Duration
- 90 min
TRAIN. REPEAT. IMPROVE.
Make cyber fitness
part of the way you prepare.
Build response muscle memory through purposeful practice.
Strengthen team habits through reflection and follow-through.