A guide to selecting the right scenario for your exercise, covering risk areas, scenario types, and where to start your exercising journey.
Search by risk area
Our scenarios have been created to cover a variety of risk areas. These represent a range of human-related security vulnerabilities and include:
Authentication
Actions and processes related to verifying a user's identity, such as using complex passwords and multi-factor authentication.
Physical security
Actions and processes related to protecting assets and people from physical attacks and unauthorized access, such as building entry procedures, locking doors and cabinets, being aware of onlookers, and using privacy screens.
Device security
Actions and processes related to securing laptops, smartphones, and other connected devices, such as connecting to insecure WiFi, using a VPN, installing updates promptly, and not plugging personal or unknown devices into work devices.
Browsing securely
Actions and processes related to safe online browsing include responding to browser security alerts and checking for security information on websites (such as HTTPS) before making payments.
Data handling
Actions and processes related to collecting, storing, using, and disposing of data, including sharing that data with others and considering data privacy.
Security reporting and responsiveness
Actions and processes related to reporting security incidents, data breaches, or suspicious activity, and responding proactively to security threats, such as changing passwords quickly following a potential breach.
Digital footprints
Actions and processes related to managing an individual's online presence, such as using appropriate privacy settings on social media, refraining from sharing information publicly, and identifying risks associated with online information.
Social engineering
Actions and processes for detecting and preventing malicious influence and deception attempts, such as spotting phishing emails and verifying callers and messages.
You can find the risk area that each scenario covers in the catalog when browsing for scenarios. Most of our scenarios cover between one and three risk areas, but some cover four or five at once. These can be useful for quickly getting an overview of participants' performance across a range of security behaviors.
Browsing scenarios by risk area lets you streamline and target interventions where you need them most.
Workforce Exercising catalog: understanding scenario types
The Immersive Labs Workforce Exercising catalog contains several different types of scenarios.
Standard scenarios
Standard scenarios typically cover between one and three risk areas. They're written with a rich, realistic narrative from a single character's point of view, and the participant makes decisions based on an evolving storyline.
Multi-role scenarios
Multi-role scenarios are similar to standard scenarios, except that the participant plays different characters at different points in the story. This means they make decisions across multiple job roles as the storyline evolves.
Baselining scenario
An assessment-focused scenario. We recommend assigning this scenario at the beginning of your exercising journey to collect baseline data, identify priority areas for interventions, and monitor your human cyber risk profile over time.
Template scenario
A standard scenario that follows a narrative storyline but requires customization. While all of our scenarios can be customized, this type cannot be run without it. Fill in the blanks to replace business names, logos, contact details, rich media, and more, to personalize the scenario to your organisation.
Policy and regulation scenarios
These scenarios focus on exercising in relation to specific regulations or standards, which are reflected in the scenario titles – for example, ISO 27001 and the Digital Operational Resilience Act.
Phishing assessment scenarios
These scenarios are solely focused on social engineering, with participants facing multiple decisions related to phishing, smishing, vishing, and similar threats. They don't follow a standard narrative; instead, the focus is on assessment and the ability to spot the phish.
Browse our catalog of scenarios here:
Your journey through our content
Start with our Security Hygiene Compass scenario
We suggest that all organizations start their exercising journey with our baselining scenario, the Security Hygiene Compass. This scenario is longer than the others, but it covers all of the eight risk areas and has been designed to collect data in a robust and systematic way. This will help you to understand your current risk profile and identify areas where further upskilling or exercising may be necessary. It’s up to you how often you run this exercise, but we recommend running it at least annually to provide a consistent monitoring point over time.
Based on the results of this exercise, you can decide where best to target any upskilling efforts that may be required. This may include assigning labs on specific topic areas, or more in-depth scenario exercises based on these topic areas. Scenarios and labs are designed to be completed in around 10 minutes to fill the gap between meetings. To maintain engagement, we recommend little and often in terms of assignment; for instance, a different scenario could be assigned bi-monthly or quarterly.
In addition to the Security Hygiene Compass, we suggest focusing on those areas that are most important to your organization, considering current threats facing your sector or organization, previous incidents, or areas that you have particular concerns about. You may also wish to roll out exercises as part of a wider programme of planned security awareness campaigns.