We use essential cookies to keep the site working. If you accept, we also load the LinkedIn Insight Tag to measure our October campaign. Cookie Policy
MANAGE
BEHAVIOUROPS · GAME 06
NEWMOBILE FIRSTALL STAFF · LEADERS · TECHNICAL

INCIDENT

ROOM

A cinematic cyber investigation game. Teams are dropped into a live breach - real-looking evidence, real decisions, real consequences. They investigate what happened, how, and why - then name the human behaviour that made it possible.

TRY THE DEMO →SEE PRICING →
10–45
MINS
2–200
PLAYERS
3
DIFFICULTY TIERS
0
APP DOWNLOADS
THE GAME

HOW INCIDENT ROOM WORKS

01
THE BRIEFING
Teams receive an opening briefing: an incident has occurred. Systems are compromised. The investigation begins now.
02
REVIEW THE EVIDENCE
Teams sift through real-looking evidence - emails, messages, logs, access records. Classify what's relevant, what's a red herring.
03
BUILD THE TIMELINE
Order the key events. When did the attack actually begin? What did people miss - and when could it have been stopped?
04
SUBMIT YOUR CASE FILE
Identify the entry point, name the human behaviour that made it possible, and name the control moment that could have changed everything.
05
THE DEBRIEF
The facilitator reveals the full story. Every missed signal. Every poor decision. The exact moment the breach became inevitable - and how to prevent it.
THE EVIDENCE

REAL-LOOKING. REAL-FEELING.

Every piece of evidence is designed to look exactly like what your team sees every day. That's what makes the decision feel real - and the debrief land hard.

📧
Phishing Emails
Realistic email threads with embedded red flags
💬
Teams Messages
Slack & Teams conversations between staff
🔐
MFA Alerts
Push notification logs and authentication records
📋
Access Records
System login logs and VPN connection data
🗂️
Helpdesk Tickets
IT support tickets that predate the incident
🌐
Social Posts
OSINT material from public profiles
THREE DIFFICULTY TIERS

ONE GAME. ANY AUDIENCE.

The same case. The same evidence. Three levels of depth - so Incident Room lands whether you're running it with the board, the whole team, or your security function.

BOARDROOM
Directors, Trustees, Senior Leadership
⏱ 20–30 mins
Strategic decision-making and governance risk
GENERAL STAFF
All employees, cross-functional teams
⏱ 25–35 mins
Human behaviour and everyday security habits
TECHNICAL TEAMS
IT, Security, DevOps, Engineering
⏱ 30–45 mins
Deeper incident analysis and detection failure
THE SCIENCE

WHY IT ACTUALLY CHANGES BEHAVIOUR

Reading about a phishing attack doesn't change behaviour. Experiencing it - investigating one, understanding why someone fell for it, naming the decision that made it worse - does.

Incident Room puts teams in the investigator's seat. That shift in perspective - from passive learner to active analyst - is what makes the lesson stick.

ACTIVE RECALL
Teams search for answers, not receive them. Active recall increases retention by up to 50% vs passive delivery.
NARRATIVE IMMERSION
The story format triggers emotional engagement. People remember stories, not bullet points.
COLLABORATIVE PRESSURE
Teams argue, debate, and decide together. That shared experience creates shared accountability.
DEBRIEF MOMENT
The reveal - when teams see what they missed - creates a powerful, memorable learning moment.
GET STARTED

READY TO RUN YOUR FIRST INCIDENT?

Try the demo free. No download, no account. If it's the right fit, you're running your first session in minutes.

TRY THE DEMO FREE →SEE PRICING →