Breaking Point OT

Crisis Exercises

The plant is running. The process data is lying.

One seat for you, in a room with thirteen others. Four hours under pressure, a role in an industrial organisation under attack, and deciding on information that does not add up.

You do not discuss what you would do; you do it, against the clock
The plant is fictional, the problems are not: every inject comes from a real case
PLCs, HMIs and vendor connections, not a factory as scenery
No tabletop and no theory: you work on our crisis platform
Book as an individual, you do not need to bring a team

What is included

A role in the crisis team of a fictional industrial organisation
Four hours of live simulation on the CyberBusters crisis platform
Injects with technical evidence: log files, process data, alerts
A scenario built from incidents we have run into in practice, not from an invented script
Facilitators who have sat in real crisis rooms, not only in exercises
A joint after-action review in which every decision is walked back through
A personal certificate with a number anyone can check
Lunch, coffee and drinks afterwards
One seat in an edition of at most fourteen participants; the price is per person

Who it is for

For people responsible for a process that has to keep running, who want to know what they do when it cannot.

You do not have to be a specialist in everything. The crisis team is mixed on purpose, because that is what it is in reality: one reads the process data, another calls the supplier, and somebody has to decide whether the line stops.

OT security engineers and OT/ICS architects
CISOs and security managers with industrial environments in scope
Plant managers and operations managers
SOC analysts and incident responders picking up OT
Consultants advising industrial clients
Anyone who gets asked, in a crisis, whether production can continue

Why come on your own, without your team:

You sit with people from other organisations and see how they read the same situation
Afterwards you know whether you want your own team to do this, without booking a full day first
You take back a way of working you can use on Monday
You find out what pressure does to your judgement, and there is no other way to learn that

Outcome

Afterwards you know:

how you decide when the process data cannot be trusted
how much time it costs before engineering and the board speak the same language
whether you can tell a fault from an attack, and how long that takes
what happens when the supplier you need does not pick up
how the decision to stop production actually falls, and who carries it
where your own judgement shifts once the clock is running

And you learn something about yourself that no course will teach you: what pressure does to your language, your timing and your willingness to take a decision that may turn out wrong.

Four things, all of them checkable.

We have run cyber crisis exercises for organisations that genuinely needed them. Our facilitators have sat in real crisis rooms, not only in exercises.
The simulation runs on our own crisis infrastructure with our own inject platform: scenarios, timers, tasks and evidence arrive when they should.
Technology and crisis management in one pair of hands. Decision making follows BOBOC, not as theory up front but as the order you are brought back to the moment the team starts floundering.
Industrial depth: we teach the PECB ISA/IEC 62443 Lead Implementer course, and it shows in the scenario.

The thinking behind it is in our practice paper Crisis in practice, free to read and download on our site.

What happens in the room stays in the room. Participants, organisations and observations do not go anywhere.