Banks, payment processors, insurers and regulators all run on shared digital infrastructure. A single payment passes through a dozen systems. That is efficient, and every integration point is also a way in. A breach in one organisation ripples across all of them, which is why the weakest organisation sets the security posture of the whole network.
Cyber Tempest puts each team in charge of one organisation inside that network. A crisis unfolds across it, and every team is deciding at the same time, on partial information, about events that involve the others. Cyber defence turns out to be about collaboration under pressure: sharing intelligence, allocating scarce resources, and judging when a partner can be trusted.
The Byzantines protected their empire for a thousand years on principles modern cybersecurity is still rediscovering. The technology changed. The thinking did not.
Every team runs an AI-enhanced security stack. The tools process a flood of logs and alerts, correlate them, and recommend action. Sometimes they are right. Sometimes they return a confident result that misses the point entirely, because each one has a blind spot built into its architecture.
Watches every system at once and correlates patterns across millions of log entries, firing an alert when behaviour matches a known attack.
Blind to partner systems, planned changes and business context.
Learns what normal looks like for each person and system, then flags anything that deviates from that baseline.
No access to HR systems or approvals, so a legitimate role change looks identical to a suspicious one.
Aggregates known attack indicators from external feeds and internal detections, and scores how severe each vulnerability is.
Scores technical severity only. It cannot weigh your maturity gaps or your business priorities.
Examines audio and video for the voice patterns, facial movement and compression artefacts that generated media tends to leave behind.
Current deepfakes routinely pass these checks. A clean result does not mean genuine.
This is the heart of the session. The tools are architecturally separated from context, values and judgement, and those are exactly what the decision needs. Teams have to work out when the output is worth acting on and when it has to be overridden.
The scenarios run in three phases. Each one is anchored to a different civilisation in the room, so every team faces a moment that plays to its own instincts and several that do not.
A partner connection running far above its baseline, with no malware signature and no threat feed correlation. Investigate, or isolate and damage the relationship?
An instruction that appears to come from the top. Teams analyse the recording themselves, knowing the forensics may clear a fake.
What you owe your competitors when the flaw is in infrastructure everybody depends on.
Teams allocate finite resource across competing fronts and live with what they left uncovered.
Behaviour that looks wrong and may be entirely legitimate. The cost of being right, and the cost of being wrong about a colleague.
Sharing strengthens the network and exposes your own position. Teams decide how much to give and who has earned it.
Teams choose between real disclosure statements, weighing what protects the numbers against what stands up later.
The governance question that follows every incident, asked while the decisions are still fresh.
A trust meter runs throughout, tracking how each team's decisions land with its partners. Trust opens doors during a crisis. Isolation closes them.
Each team inherits a way of thinking about threat, risk and trust, drawn from how its civilisation actually defended itself. The Byzantines built the Theodosian Walls in three independent layers, each assuming the one in front would fall. That is zero trust, and it is a thousand years old.
Every team recognises its own approach and runs into its limits, which is the point: no single philosophy survives every scenario.
Offered in facilitated engagements, on its own or alongside a Tech Tempest day. Talk to us about shape and length.
Security, risk and leadership teams. No technical background is assumed, and every term the scenarios use can be opened up in plain English inside the app.
A trained facilitator runs the session. Your people need no preparation.
A room, a screen, and a laptop per team. Your IT team needs shift127.com allowed through the network, or the app will not open.
The simulation, the scenarios and the intelligence behind them. Nothing is installed on your network.
Tell us who would be in the room and what you want them to come away with, and we will come back with dates and a price.
Book a Session