Fintech · Payments & Identity
Cendra Financial Technologies
vs GRAYFROST
A payments-and-identity fintech pre-IPO — fraud-scoring IP, KYC data, and an S-1 in flight.
Facilitated cyber war game · 10 scenarios · four threat surfaces
Run the attack
before it runs you. Then fix what it found.
A nine-move adversary campaign against a fictional company dressed up as yours. Your CISO, General Counsel, CFO, CEO and board take the real decisions under a running clock — legal, regulatory, financial, reputational — and leave with a corrective action plan a regulator accepts, not a slide deck and a good feeling.
What leaves the room
Three documents, generated from what the room actually decided.
Same day
After-action report
Every decision by role with its liability note, the evidence each seat saw, and the chain of early calls that compounded later. Branded to the client, printable to PDF.
Same day
Compliance report & corrective action plan
Findings derived from the gaps, mapped to NIST CSF, with named owners, due dates, priority and a sign-off block. Exports to Jira, ServiceNow or a spreadsheet.
Quarter over quarter
Readiness trend report
Exposure per exercise, findings raised versus closed, days to close, overdue items, and an anonymised benchmark against the portfolio. The board-ready proof that the program changed something.
How a session runs
Half a day. Nine moves. One decision per seat per move.
Scope and customizePick the scenario by regulator. Rename the target, drop in the client's real numbers, brand the reports. No code.
Seat the roomPlayers join from their own devices with a four-character code and take a seat. A projector mirrors the room at the front.
Play the campaignEach move lands with evidence routed to the right seat — an alert, an email, a regulator's letter — and a timer. Seats decide; the facilitator reveals.
Debrief and planThe verdict, the full recap, and the corrective action plan built in the hotwash with owners and dates. Saved to the client's record.
10 scenarios · legal sign-off on every one
Seven intrusion campaigns, and three adversaries that don't need malware.
Same engine, same scoring, same report — a different world, regulator and adversary each time. A returning client changes the threat surface, not just the skin.
Credit Union · NCUA
Harborlight Federal Credit Union
vs NIGHTJAR
A member-owned CU mid-merger — NCUA Part 748, Reg E fraud, a core-banking CUSO, a volunteer board.
Healthcare · HIPAA
Alderpoint Health System
vs CARRION
A regional hospital system — PHI, an EHR that runs the hospitals, patient safety under every move.
Broker-Dealer · SEC / FINRA
Halcyon Securities
vs BLACKQUILL
A BD + RIA with $40B client assets — money-movement rails, MNPI, Reg S-P, and net capital.
Critical Infrastructure · NERC / EPA
Ironvale Power & Water
vs BLACKSTART
A combined electric + water utility — SCADA, the grid, the plants; the crown jewel is a physical process.
Manufacturing · DFARS / ITAR / SEC
Vantar Precision Industries
vs COLDFORGE
A public tier-1 aerospace & defense supplier — the plant floor, ITAR drawings, and recipes that decide whether a part is made right.
Digital Trust · Post-Quantum
Keystone Trust Services
vs GLASSWING
A certificate authority and identity provider against a crew that takes ciphertext on purpose — the PQC campaign, where the quantum clock runs from move one.
Payments · BEC / UCC 4A
Ashgrove Logistics
vs COUNTERSIGN
No malware, no ransom: a mid-market company's money against a business-email-compromise crew with a cloned CFO voice and a real-time rail that can't be recalled. Any sector.
Identity · IdP control plane
Clearpath Identity
vs MIRRORGLASS
A workforce-identity provider against a crew that wants its signing key: a help desk, an impersonation tool, six million logins — and the decision to log everyone out. Any sector that runs SSO.
Agentic AI · Swarm vs. your agents
Halewood Systems
vs LANTERNFLY
One operator, a thousand autonomous agents, and a company's own AI agents turned against it — the coding agent that ships, the support agent that refunds, the finance agent that pays — at machine speed. Any company that has deployed agents.
The program
Land. Expand. Quantum.
Tier 1 · Land
War-Game Engagement
$12K–$40K / exercise
A single facilitated exercise, customized to your organization and sector, in a half to full day.
- One scenario, branded to you
- 8–25 executives, facilitator-driven
- Compliance report + corrective action plan
- After-action report & executive read-out
Tier 2 · Expand
Readiness Program
$60K–$120K / year
Four quarterly exercises across different threat surfaces, with remediation tracked between them.
- Quarterly exercises, sequenced to your risk
- Open corrective actions carried & re-reviewed
- Quarter-over-quarter remediation trend
- Annual board-ready readiness report
Tier 3 · Quantum
Q-Risk Assessment
Scoped to environment
Every campaign surfaces harvest-now-decrypt-later as a live liability. Q-Risk turns that finding into a cryptographic inventory and migration plan.
- Post-quantum exposure inventory
- Cryptographic migration roadmap
- Governance aligned to NIST's transition timeline
What makes it different
Liability first. Decisions that compound. A deliverable that survives an examiner.
It isn't a technical test
It doesn't probe your firewall. It tests whether your leadership makes defensible calls when the regulatory clock is running and the facts are ugly.
Early calls come back
A shortcut in move one surfaces as a finding in move seven, the way real incidents work. The debrief shows the room exactly where.
Evidence, routed by seat
The CISO's alert is not on the GC's screen. Nobody has the whole picture, so the seats have to talk — which is the exercise.
Built for the room
A shared engagement clock, a projector view for the front screen, live rooms across every device, and a record that persists between quarters.
The second shoe
Every campaign closes on the data that doesn't rotate.
What the adversary took is protected by cryptography on NIST's deprecation timeline. The post-quantum close isn't a marketing paragraph; it's a substantiated finding in your own report, and the bridge to the next conversation.
Questions
What people ask before the first session.
What do players need?
A browser and the link. Nothing to install, no account, no sign-in. They join with a room code and take a seat. A one-page participant guide tells them what to expect.
Is any real data involved?
No. The scenarios are fictional and the customization only renames the target and drops in facts you choose to show. Reports are generated locally in the browser and saved only to your own records backend if you run one.
Can it run without infrastructure?
Yes. Every scenario ships as a single file that runs solo with no network. Live multi-device rooms and persistent records are optional.
Is it accessible?
The application passes an automated accessibility audit on every view and announces moves, evidence and the clock to screen readers. A manual screen-reader checklist is part of the kit.
Who signs off on the legal content?
Every scenario's regulatory and liability characterizations have legal sign-off. They remain training instruments, not legal advice.