📜 🗡️ 📜

Event Setup

Forge Your Quest — Assemble Your Party

═══════ ⚜️ ═══════

As the Dungeon Master, configure your tabletop event below. Name your campaign, choose the scenarios, add your participants to their departments, and generate the unique event link for your players.

Step 1 — Name Your Campaign

Step 2 — Choose Industry Vertical

Select the industry your players' organisation operates in. Adventures will be filtered to those appropriate for that sector. Choose Generic / Any Industry to see every adventure.

🌐
Generic / Any Industry

A sector-agnostic framing suitable for any organisation. Scenarios will not be filtered to a specific industry. Use this when running a mixed-industry exercise or when the players…

🏦
Banking & Financial Services

Retail, commercial, private and investment banking, payments, and capital markets. Scenarios assume regulators such as the FCA/PRA/ECB, frameworks like DORA and PS21/3, and concer…

🏥
Healthcare & Life Sciences

Hospitals, clinics, insurers, pharmaceuticals, and medical devices. Concerns include patient safety, electronic health records, HIPAA / NHS Data Security and Protection Toolkit, c…

🛒
Retail & E-commerce

Bricks-and-mortar retailers, e-commerce platforms, hospitality and consumer goods. Concerns include PCI DSS, point-of-sale malware, loyalty/account takeover, peak-trading availabi…

🏭
Manufacturing & Industrial

Discrete and process manufacturing, automotive, aerospace, and heavy industry. Concerns include OT/ICS security, IP theft, production line continuity, supply chain integrity, and …

🏛️
Government & Public Sector

Central and local government, defence, law enforcement, and public services. Concerns include citizen data, classified information handling, NCSC/CISA guidance, FOI obligations, a…

💻
Technology & SaaS

Software vendors, SaaS providers, cloud platforms, and digital-native businesses. Concerns include multi-tenant data isolation, customer breach notification under SLAs, source-cod…

⚡
Energy & Utilities

Electricity, gas, water and renewables. Concerns include critical national infrastructure obligations (NIS2 / CAF), SCADA and OT security, grid stability, public safety impact, an…

🎓
Education & Research

Schools, colleges, universities and research institutes. Concerns include student data, research IP, federated identity, BYOD environments, and limited security budgets relative t…

⚖️
Legal & Professional Services

Law firms, accountancies, consultancies and other professional service firms. Concerns include privileged client data, conflict-of-interest walls, regulator (SRA / ICAEW) obligati…

Step 3 — Choose Your Campaign

Select the type of incident campaign to run. Each campaign contains different adventures (scenarios) tailored to that threat category. 🌐 Generic / Any Industry

⚔️
Cyber Attack
4 adventures

A deliberate, malicious attempt by an external or internal threat actor to compromise the confidentiality, integrity, or availability of the bank's information…

Adversarial intent — someone is actively trying to cause harm or extract value.
🏗️
Digital / Operational Resilience
1 adventure

The bank's ability to continue delivering critical business services and recover to defined tolerances when technology systems fail, degrade, or become unavail…

Systemic or accidental failure rather than hostile action.
📂
Data Breach / Data Loss
1 adventure

Events where personal or confidential data is exposed, lost, or improperly accessed, regardless of whether a malicious actor is involved. This includes acciden…

Personal or confidential data exposure regardless of intent.
🎭
Insider Threat
1 adventure

Deliberate or negligent actions by employees, contractors, or trusted third parties. This spans fraud, sabotage, data theft, and policy violations. Often treat…

Threat originates from within the organisation's trusted circle.
🔗
Third-Party / Supply Chain
1 adventure

Incidents originating from vendors, managed service providers, SaaS platforms, or upstream software dependencies. The response is fundamentally different becau…

The incident originates outside the organisation's direct control.
🏢
Physical Security
1 adventure

Events affecting physical infrastructure such as break-ins to data centres, theft of hardware, tailgating, or destruction of equipment. Often overlooked in cyb…

Physical access or physical damage to infrastructure.
📋
Regulatory / Compliance
1 adventure

Incidents triggered by regulatory action, audit findings, or discovered non-compliance that require immediate remediation. Examples include discovery of sancti…

Regulatory or compliance obligation is the primary driver.
💰
Fraud and Financial Crime
1 adventure

Authorised push payment fraud, account takeover, fraudulent SWIFT/payment instructions, or market manipulation. For a private bank these often sit at the inter…

Financial loss or attempted financial loss through deception or manipulation.
🌪️
Business Continuity / Disaster Recovery
1 adventure

Natural disasters, power failures, building access loss, pandemic staffing crises, or major infrastructure outages that aren't caused by an adversary but still…

Non-adversarial disruption requiring continuity planning activation.
📢
Reputational / Crisis Communications
0 adventures

Sometimes categorised separately because certain events (social media incidents, executive misconduct, leaked internal communications) demand a crisis response…

Reputational damage is the primary risk, regardless of technical impact.
⚖️
Legal / Litigation Hold
0 adventures

Events requiring immediate evidence preservation due to threatened or actual legal proceedings, regulatory investigations, or law enforcement requests.

Legal obligation to preserve evidence or respond to proceedings.

Step 4 — Select Adventures

Choose and order the scenarios for your event. Each adventure will be played in sequence. Select a campaign above to see available adventures.

Available Adventures

Select a campaign above to see available adventures

Your Quest Line 0 min

Add adventures from the available list

Step 5 — Assemble Your Party

Add participants and assign them to departments. Each participant will be able to view the event in real-time from their browser using the unique event link.

Step 6 — Generate Event Link

Save your setup to generate the unique event URL. Share this link with all participants so they can follow the event in real-time from their browsers.

Save your setup to generate the event URL.