Solutions to strengthen your cyber resilience
Delivering immersive, real-world cyber incident exercising and end-to-end IT/OT security support, from consultancy and implementation to SOC capability development. Backed by evidence-driven research and strategic insight, we help organisations build sector-ready resilience.
Cyber incident exercising
Capability development
Evidence-driven research
End-to-end IT/OT security support
Incident Exercising
Practical support to strengthen incident response across IT and OT environments
Cyber Range
Realistic IT and OT environments designed for hands-on learning
Cyber Escape Rooms
Immersive, story-driven challenges that bring cyber and IT/OT risks to life
Cyber Consultancy
Practical support to assess, secure, and modernise your IT and OT environments
SOC Enablement
Building lasting detection and monitoring capability for IT, OT & CNI
Strategic Research
Strategic research and evidence-driven insights for cyber decision-making
Cyber Escape Rooms
Immersive, story-driven challenges that bring cyber and IT/OT risks to life
Our cyber escape rooms engage teams in rich, narrative scenarios where every clue, device, and network artefact matters. Participants move from physical reconnaissance to digital compromise and, in IT/OT-focused games, all the way through to production line disruption practising skills like reconnaissance, credential abuse, network pivoting, command-and-control, and Industrial Control Systems exploitation.
Make core cyber skills memorable through play.
Audience: Outreach programmes and cyber away days
A 30–45 minute escape room designed focusing on fundamental cyber hygiene and awareness. Challenges cover topics such as:
- Password security and guessing based on personal information
- Encryption and decryption puzzles
- Backup, ransomware behaviour, and basic incident response
- Network security, firewalls, steganography, and brute-force thinking
Your systems, your threats, your story.
Audience: Any organisation wanting a bespoke scenario
We work with you to design sector-specific escape rooms using your technologies, processes, and threat models. Examples include:
- OT-heavy scenarios on electrical grid or oil & gas testbeds
- Insider-threat and social engineering focused stories
- Exercises aligned with your playbooks, policies, and training goals
Consultancy & Implementation
Practical support to assess, secure, and modernise your IT and OT environments
We help organisations strengthen their IT/OT environments through practical, end-to-end consultancy and hands-on implementation. Our work includes structured assessments, architecture and network reviews, monitoring deployments, and IT/OT testbed development delivered to operate effectively in real-world operational settings.
All activities are delivered in close collaboration with client engineering and operations teams, supporting informed technical and operational decision-making. By blending engineering, cybersecurity, and sector experience, we help organisations develop solutions that align with their systems, processes, and operational constraints.
Cyber Incident Exercising
Strengthen your organisation’s ability to respond when a cyber incident happens.
Our Incident Exercising helps teams test their plans, people and processes in realistic cyber scenarios. From facilitated tabletop exercises to more immersive live-play simulations, we create exercises tailored to your organisation, systems and level of maturity.
Whether you want to validate an incident response plan, improve coordination between technical and leadership teams, test SOC and detection workflows, or identify gaps before a real incident exposes them, our exercises provide a safe environment to practise, learn and improve.
SOC Enablement
Building lasting detection and monitoring capability for IT, OT & CNI environments
Most organisations want visibility into their operational technology environments but don’t know where to start.
We help teams establish a strong foundation for IT/OT monitoring by designing architectures, deploying Cybersecurity and Infrastructure Security Agency (CISA) supported open-source tooling such as Malcolm, and guiding analysts through detection engineering, log pipelines, and playbook development.
Our focus is on building internal capability enabling your team to run, maintain, and evolve your SOC over time.
Because Malcolm is open source, organisations download it directly from GitHub, meaning there is no central tracking of who deploys it.
However, we do have strong indicators of its global adoption:
- Over 60,000 downloads (as of Nov 2025), with ~3,000 downloads every month
- 150,000+ unique visitors across Malcolm documentation and GitHub sites
- 30,000+ views of official training videos and 850+ subscribers
- Widely used across OT sectors, including water/wastewater, energy, government facilities, and healthcare
- Deployed by national agencies, including Germany, Ukraine, India, and Moldova
- Used across major U.S. federal entities, such as CISA, DoE, FBI, Bureau of Reclamation, USAF, USN, and the U.S. Army
- Adopted by state/local municipalities and several universities for research, monitoring, and training
Use cases range from: continuous OT network monitoring, proactive threat hunting, incident response analysis, one-off visibility assessments, integration with commercial tools, training and upskilling analysis.
We support organisations in establishing and evolving OT-focused monitoring capability, working alongside internal teams to design architectures, deploy tooling, and plan sustainable SOC development.
- SOC architecture design, including network visibility, log flows, and segmentation points
- Integration with existing IT SOC tools and workflows
- Deployment and integration of Malcolm, the open-source OT monitoring suite
- Design of telemetry and log pipelines (e.g. Zeek, Suricata, syslog, PCAP capture, asset inventory)
- A tailored SOC maturity roadmap covering people, processes, detection content, dashboards, and technology evolution
We support organisations in developing and refining detection capability for OT environments, working alongside internal teams during guided exercises and workshops to explore how detections can be created, tested, and evolved over time.
- Detection logic for PLC traffic and common ICS/SCADA protocols
- Identification of abnormal behaviour and representative attacker techniques
- Use of network and telemetry data to support investigation and triage
- Reviewing detection assumptions, thresholds, and limitations
- Demonstrating approaches for maintaining and adapting detections as environments change
Research, Analysis & Strategic Reports
Strategic research and evidence-driven insights for cyber and IT/OT decision-making
Organisations often need clear, defensible analysis to guide investment, policy, and operational priorities especially across IT, OT, critical infrastructure, cybersecurity regulation, and public services.
We deliver structured research, comparative assessments, and analytical reports that translate complex technical information into actionable insight for leadership and engineering teams.
Our work blends cybersecurity research, regulatory analysis, incident economics, and IT/OT engineering knowledge to produce reports that shape strategy, justify investment, and support national or organisational decision-making.
Trusted partners
Let’s build cyber resilience together
From training to testing to innovation, if you’re building something that needs to stay secure, we’re ready to help you simulate, learn , and protect what matters.