Executive Crisis & Tabletop Engine

Incident Response Tabletop Simulator

Stress-test your team's operational resilience against realistic, high-profile cyber crisis scenarios. Derived from real-world post-mortems and SANS / OffSec defense principles.

Critical Severity SimulationEst. 45 mins

Cloud Identity Provider & Token Hijack

MFA fatigue, stolen session cookies, and administrative account takeover

Real-World Context & Curriculum Alignment

Incident Origin: Inspired by real-world Identity Provider & contractor compromise incidents (e.g. Okta / Lapsus$ / MGM Resorts)

SANS SEC559: Identity Security for Cloud and Hybrid

Threat Actor Profile

Financially motivated extortion group utilizing infostealer logs and targeted social engineering

Initial Access Vector

Compromised personal laptop of a third-party customer support contractor with active session cookies and MFA fatigue push bombing

Statutory Disclosure Timers & Compliance Clocks

DORA Article 19: Initial notification within 4 hours of classifying as a major ICT incident

GDPR Article 33: Supervisory authority notice within 72 hours of awareness

SEC Form 8-K: 4 business days post-materiality determination

Opening Incident Briefing (T+0 Hours)

“At 02:15 CET, your Cloud SIEM detects an administrator login to your primary cloud Identity Provider from a residential IP in an unexpected country. The session used valid session cookies extracted via infostealer malware, followed by 18 push notifications sent to the contractor until one was accepted at 02:14 CET. The attacker has created two new service principals and reset MFA for a senior database engineer.”

Simulation consists of 3 interactive crisis decision injects.