From Simulation to Strategy: Empowering Crisis Readiness at SANS
In this blog, I share my perspective as a cyber resilience advisor, exploring how SANS equipped its team to design and deliver exercises based on real-world incidents. What started as a one-time event has become an ongoing project to build internal capability and use the platform for continuous team development and upskilling. A tailored event On May 26, we ran a crisis simulation event with the cybersecurity team at SANS, an organization where cybersecurity plays a critical role in protecting aviation operations and national infrastructure. The scenario, adapted from the Immersive catalog, was tailored to the aviation industry and focused on a targeted malicious code attack exploiting the Follina vulnerability (CVE-2022-30190). It brought together the SOC, incident response, and IT/OT teams to work through a high-pressure situation that tested their ability to detect, contain, and recover from a cyberattack. While the simulation itself was valuable, what stood out most was the team’s immediate interest in expanding their internal capabilities and using the Immersive platform to create their own simulations in the future. Enabling ownership Following the event, we hosted two hands-on workshops to support the team in designing their own crisis simulations. The first workshop focused on developing familiarity with the platform. SANS explored the Crisis Simulation module, navigated the scenario catalog, and learned how to use existing content as templates to build custom scenarios. After participating in this workshop, the head of cybersecurity at SANS described it as “truly interactive, well-executed, and highly engaging… The hands-on approach and practical scenarios helped enhance our technical readiness and cross-team coordination”. The second workshop walked through the full development process, from discovery and design to development and build, helping the team shape a simulation based on a real incident from their organization. Together, we explored how simulations can be used not just for readiness, but as a practical upskilling tool grounded in real operational risk. A collaborative path forward What began as a single simulation has turned into an ongoing partnership. We’re now supporting the SANS team as they take ownership of their crisis readiness, developing internal simulations aligned with their environment, challenges, and goals. This is the value of Immersive in action: not just running simulations, but empowering teams to build their own scenarios. Creating a playbook for success While working with SANS, we used the Malicious Code: Incident Responder crisis simulation from the Immersive catalog as the foundation, changing the decision points (known as injects) to fit the roles that were participating in the simulation. After additional tweaks to the terminology and narrative to better represent the aviation industry, we were able to accurately model a realistic scenario for SANS. You can follow a similar process to create your own crisis simulation framework. Simply export a scenario from our catalog as a building block and personalize it to suit your industry and needs. Keep these tips in mind: Customize the terminology used in the scenario to reflect your organization. While many of our out-of-the-box scenarios refer to financial services or government, they can easily be adjusted. Use historical incidents to shape the crisis simulation and explore best practices. By cataloging events that have happened within your company or industry, newer employees can use this knowledge to better prepare for similar challenges in the future. Encourage teams to share knowledge using the platform based on their experience, so colleagues can learn from examples. Engage your own procedures and policies to create a playbook for the future. Beyond the tabletop: Expanding the value of crisis simulation Running a crisis simulation is just the beginning. Once a team has participated in a full-scale exercise, there’s a powerful opportunity to build on that momentum using the same tools to embed resilience deeper into the organization. Here are just a few ways teams can expand the impact: Explore team-based microsimulations to reinforce best practices. Use short, focused exercises (15–30 mins) to target the specific response skills of a single team. Engage in case study reflection exercises. Take a real incident (internal or public), build it into a learning scenario, and allow teams to step through the decision-making and ask: “What would we have done?”. Beyond crisis: Using the platform for everyday development Crisis simulations are powerful — but the platform can also support ongoing team growth outside of high-pressure scenarios. Beyond crisis response, organizations can use Immersive to: Onboard new team members. Introduce new joiners to tools, roles, and escalation paths through guided, scenario-based learning. Provide career development paths. Use simulations to expose team members to higher-level decision-making, preparing them for future roles in incident leadership or governance. Do you have any alternative use cases for crisis simulations beyond crisis response itself? Share them in the comments!A Step-by-Step Guide to Hosting Your Own Hacktober Event
Organizing engaging, informative, and enjoyable cybersecurity events like Swisscom's Hacktober event doesn't have to be daunting. With strategic groundwork and relevant, interactive challenges, you can create a cybersecurity event that is both fun and educational. Are you considering hosting a similar cybersecurity event? This blog provides a step-by-step guide to creating an impactful event, resulting in a more skilled and prepared workforce.
The Immersive Advocacy Program
We are thrilled to announce the official launch of the Immersive Advocacy Program, an exclusive initiative designed to recognise and reward our most engaged community members and Immersive platform users. After a round of criteria-based applications, you may notice that a small number of your community peers have earned a new badge, which they have been awarded for enrolling as Immersive Advocates. You can expect to see advocates lending a helping hand over in the Help Forum, authoring customer success stories and blueprints, like NHSCyberMan's Tackling technical challenges: Attending Immersive’s cyber drill in London, steven's Step-by-step guide to hosting your own hacktober event, and maybe you’ll even catch them speaking at events. Another core pillar of the program is product innovation, and those on the program have already taken to providing invaluable feedback on new features and beta testing a new community layout 👀 In return for their contributions, our advocates receive a range of exclusive benefits from access to Team Immersive, a private advocacy community group, and an advocate badge, which you may have already spotted on some of your peers’ community profiles. We know many of you are passionate about Immersive and the wider cybersecurity community, and we are excited to expand our program. While applications are closed for now, future opportunities will become available over the course of this year and next. If you’d like to be in with a chance, community engagement is the name of the game!Mastering Crisis Sim: How We Got 25 Execs on the Edge of Their Seats
Let's start with the requirements. In this case, they were clear: 1) To have a fully customised exercise focusing on payment risks and cyber threats like fraud, ransomware, and cash-outs. This is the domain expertise of Mastercard, who had no issues creating this in the Immersive platform with our review and guidance. 2) To deliver this on-site in front of 25 senior execs (including the CEO, CTO, CISO, CFO, and numerous heads of departments). It’s definitely not easy getting this many board members together in one room, so we had to make the first best impression! What did we do, and why was it a success? The stakeholders told us that they’d run tabletop exercises before, so this wasn’t new to them. So, how did we turn what they expected to be a routine drill into an edge-of-the-seat experience? What made our approach unique? Realistic AI-generated videos The amazing Crisis Sim content creation team at Immersive Labs used generative AI to create highly realistic videos that felt as though they were straight from a Pakistani news channel. Mastercard provided us with a few scripts and ideas that helped bring the AI videos to life. AI video of a news reporter tailored to resemble the Pakistani news channel. AI video of a news reporter tailored to resemble the Pakistani news channel. Why did the execs jump out of their seats? That’s because we included the following in the videos: Footage of their building on the news and customer dissatisfaction over cyberattack repercussions. News reporters with local accents and dress styles mentioning the bank and stakeholders, and unhappy Tweets flooding social media. A video of their CEO, not his real face of course, but we used his name when it came to an inject where the stakeholders voted for ‘releasing a press statement to the public’. They even specifically asked us to ensure none of these videos leaked! But each video included the message “Exercise use only – not based on real events”. AI video of the CEO giving a press conference. Collaboration This success was a team effort. Getting any presentation done right, especially in person, requires planning and knowing your audience. This is where Mastercard brought their expertise to create and tailor the Crisis Sim exercise while we supported with our guidance and previous customer experience knowledge. Our roles, tasks, and responsibilities were clear. Top tip: If you’re planning an exercise, collaborate with others for ideas and support. Double act presentation Presenting as a team made all the difference. Mastercard’s expertise in engaging senior execs helped animate the session and avoid awkward silences, while I focused on facilitating the exercise. Doing this alone can be tricky – I’ve personally struggled with awkward silences during solo Crisis Sim sessions while juggling scenario questions, multiple responses, feedback, and facilitation all at once. Sharing the load was crucial, especially in a U-shaped room where I couldn’t easily move around. In this case, I didn’t need to worry about moving away from my laptop, leaving the close-up engagement completely for Mastercard to lead on. Image example of the U-shaped conference room this took place in. The feedback The feedback was overwhelmingly positive – they said it was their first experience with such a tabletop exercise, a stark contrast to their initial expectations. The AI videos sparked significant interest and curiosity. The collaboration between Mastercard and Immersive Labs successfully delivered an educational, engaging, and tailored exercise. The bank expressed interest in running a wider crisis drill in 2025 with multiple banks. So look forward to hearing about that in the future! Finding AI video scenarios in our Crisis Sim Catalogue If you clicked on any of the AI images above thinking it was a video, I’d like to apologise. They were just screenshots as the actual videos included sensitive, bank-specific details like names and locations that we can’t share externally. If you’d like to explore AI video scenarios in our Crisis Sim platform, check out titles like: Boardroom Betrayal: When Deepfakes Strike the Top Puppetmaster’s Revenge The Walls Have Ears – Part One The Walls Have Ears – Part TwoDefend as One: Breaking Down Technical Barriers Across an Organisation Through Technical Team Exercising
This article details how a public healthcare account used Immersive Labs’ Cyber Team Simulation for a cross-departmental May Day programme, benchmarking national cyber capabilities. As their Cyber Workforce Advisor, I’ll outline the steps taken, from planning to execution, to achieve this strategic programme.Announcing the Winners of the 2024 Customer Awards!
This Cybersecurity Results Month we’re acknowledging the organizations and individuals who have shown exceptional dedication to learning and defending against emerging threats, building organizational resilience and pushing the boundaries of their cybersecurity knowledge through the Immersive Labs platform. Collectively, our customers have completed tens of thousands of labs, and after crunching the numbers, we’re ready to celebrate just some of the winners amongst exceptional individuals and organizations that have excelled in 2024 across the following categories: 👾 Emerging Threats Award The Emerging Threats award recognizes the organizations and individuals at the forefront of threat detection and threat hunting. Taking into consideration the total number of Cyber Threat Intelligence labs completed, as well as the average time to complete and respond to every new CTI lab, we’re rewarding the best and brightest for their diligence and dedication in responding to the latest threats quickly and effectively. 🏆 Emerging Threats Award Organization Winners: Cisco Systems Swisscom Arctic Wolf InfoGuard Specsavers BT Group Their proactive approach to the completion of CTI labs has set them apart as leaders in cybersecurity defense. Congratulations on your exemplary performance! 🏆 Emerging Threats Award Individual Winners: steven Steven Glogger, Swisscom Anonymous Paul Blance, Specsavers Steffen Wacker, Arctic Wolf These record-holding individuals are second to none for completed CTI labs this year! Congratulations on your exemplary performance! 🛡️ Cyber Resilience Award The Cyber Resilience award recognizes those organizations that are maximizing the full use of the Immersive Labs platform to fully optimize their end to end cyber resilience. The award zeroes in on the breadth and depth of coverage across the MITRE ATT&CK framework, and identifies those organizations that have taken it upon themselves to build Immersive Labs fully into their own cyber resilience program. 🏆 Cyber Resilience Award Winners: BT Group Swisscom Arctic Wolf Their comprehensive approach to cyber resilience, maximizing the capabilities of the Immersive Labs platform, has put them at the forefront of cyber defense strategies. They’ve not only protected their organization but set a standard for the industry. 🔥 Immersive Labs Trailblazer Award Our final award, the Immersive Labs Trailblazer award recognizes those individuals that simply love Immersive Labs - they have been our top point scorers since Jan 1st 2024, completing thousands of labs and truly immersing themselves in the platform. These individuals go above and beyond their assigned learning programs to upskill and explore content outside of their day to day roles and responsibilities. 🏆 Immersive Labs Trailblazer Award Winners: J Nicholas Autumn, UK Home Office steven Steven Glogger, Swisscom Steffen Wacker, Arctic Wolf Their commitment to learning and exploring every corner of the Immersive Labs platform sets them apart as a true cybersecurity trailblazer. Congratulations to all of the winners for setting the best-in-class standard as we grow and enhance our cyber resilience, together 👏Announcing the Cybersecurity Results Month 2024 Awards🏆
As we celebrate Cybersecurity Results Month, it's time to recognize the organizations and individuals who have shown exceptional dedication to learning and defending against emerging threats, building organizational resilience and pushing the boundaries of their cybersecurity knowledge through the Immersive Labs platform.
