Lead your organisation through years of cyber pressure. Balance resilience, investment and trust, confront incidents with your team and see the consequences of the risks you choose to take.
The common learning loop for students and teachers: orient, make a defensible call, and use the outcome to improve the next one.
01 · Orient
A live case file combines the threat landscape, company metrics, role-specific priorities, and the decision budget.
02 · Decide
Each role records a recommendation and rationale. The team resolves trade-offs before one shared portfolio is committed.
03 · Debrief
Metrics, incidents, score limits, and the class comparison make the connection from choice to consequence visible.
Deferred security compounds
Every decision modifies the organization's risk. Invest early and exposure stays flat for years. Defer it, and the cost does not wait, it compounds, quietly, until a single incident makes the whole bill due at once.
Frameworks you'll learn
The simulation is grounded in the models security teams actually use.
Defense in depth
Layered controls from perimeter to data.
The kill chain
Where a single control breaks an attack.
Coverage vs. gaps
Mapping attacker techniques you can detect.
A 15-round journey
From first optimism to the deepfake finale, the human arc of fifteen years of decisions.
Four Case Organizations
Each team is assigned a fictional company, spanning Iceland, Norway, and Italy, with unique risks, pressures, and vulnerabilities. No two journeys are the same.
Fintech / Digital Banking
NordPay
A Reykjavík-based digital finance company founded in 2014. Started as a small payment processing platform and grew into a regulated fintech provider offering mobile banking, cross-border transfers, and lending. Serves both retail customers and SMEs across Iceland and expanding into Scandinavia. Its core product is a real-time cross-border payment rail built on correspondent-bank partnerships and open-banking APIs, which is exactly what makes payment fraud, credential stuffing, and third-party API dependency existential rather than theoretical risks. Its licence as a regulated e-money institution under EEA financial law means every incident carries PSD2 and AML reporting obligations on top of the technical cleanup. NordPay owns no branches and runs almost entirely on outsourced cloud infrastructure and vendor-supplied fraud-scoring models, so a single cloud-region outage or a compromised vendor can halt payments for its whole customer base at once.
Reykjavík, Iceland
Payment fraud…Regulatory compliance…
Fisheries & Seafood Export
Hafskip Seafood
One of Norway's largest vertically integrated seafood exporters. Operates a fleet of fishing vessels, cold-chain processing facilities in Ålesund and Kristiansund, and logistics networks spanning 30 markets. Depends heavily on ERP systems, IoT cold-chain sensors, and international EDI connections with customs authorities. Norway is one of the world's largest seafood exporters, and Hafskip's margins depend on an unbroken cold chain from trawler to customs desk, which is exactly why a ransomware outage or a tampered sensor reading is a product-safety and export-certification crisis, not just an IT one. Its trade runs through EDI links and customs integrations with food-safety authorities in every market it ships to, so a compromised logistics partner or a falsified temperature log can trigger a blocked shipment or a suspended export licence long before anyone confirms a breach. Much of its shop-floor and vessel technology is decades-old operational technology bolted onto newer IT systems, which is the direct source of its legacy ICS exposure and its dependence on third-party logistics providers it cannot fully audit.
Bergen, Norway
Ransomware disrupting…IoT sensor…
Renewable Energy / Geothermal
Eldur Energy
A fictional Italian renewable energy operator managing geothermal power stations across the Larderello-Travale field in Tuscany, the birthplace of commercial geothermal power in 1904, hydroelectric plants on Alpine rivers in the Adige valley, and an emerging wind portfolio. Operates critical grid infrastructure, remote SCADA monitoring systems, and supplies power to industrial customers, data centers, and regional distribution networks. A portion of capacity carries a minority stake held by Cassa Depositi e Prestiti, Italy's state investment institution, reflecting the same logic Rome applies to other strategic infrastructure. Geothermal and Alpine hydro together supply a meaningful share of Italy's electricity, which makes Eldur's SCADA and remote-plant-control systems part of the country's critical infrastructure rather than merely its own, a distinction regulators and attackers both understand. Its geothermal stations sit on decades-old industrial control systems layered with newer remote-monitoring software so operators do not need to drive to a remote wellhead, which is exactly the IT/OT boundary its coreRisks describe. Because a large share of national supply routes through a small number of plants, sabotage or a nation-state probe of Eldur's control systems has consequences that scale well beyond one company's balance sheet.
Larderello, Tuscany, Italy
SCADA/ICS intrusion…IT/OT boundary…
Tourism & Hospitality
Arctic Horizon
A Reykjavík-based tourism and hospitality platform managing bookings for tours, accommodations, car rentals, and experiences. Operates a mobile app, B2B partner integrations, and a customer loyalty program. Revenue is heavily seasonal with peak summer traffic representing 60% of annual bookings. Partnered with over 200 local operators. Arctic Horizon takes a booking fee on top of what its partner operators charge, which means its core asset is trust: the payment card data, passport scans, and travel details customers hand over expecting one well-run platform, not 200 separate ones. Almost two-thirds of its annual revenue and its heaviest platform load land in a ten-week summer window, so an outage, breach, or ransomware incident during that window has no slow season to recover in. Its partner integrations and outsourced app development give dozens of external parties access to booking and customer data, which is the direct source of its third-party and cloud-misconfiguration exposure, and its consumer-facing brand means any incident plays out publicly on social media rather than quietly in a back office.
Reykjavík, Iceland
Customer data…Payment card…
15 Years of Escalating Threats
From early cloud adoption to AI-powered attacks and post-quantum crises, every year brings new threats and harder trade-offs that compound across a decade and a half.
2016
Digital Optimism
2018
GDPR Reckoning
2021
Ransomware Wave
2022
Log4Shell Fallout
2025
The Major Incident
2027
KEV Exploitation
2028
Supply Chain Crisis
2029
OT/IT Convergence
2030
AI-Assisted Fraud
Selected milestones across the simulation arc, each compounds the choices before it.
Built for Learning
CyberSim combines serious game design with academic rigor, creating an experience where decisions have real consequences.
15-Year Risk Simulation
Navigate 15 annual rounds of cyber risk decisions from 2016 to 2030. Each year brings new threats, regulations, and strategic trade-offs.
Role-Based Team Play
Six distinct roles, CEO, CFO, CISO, COO, Legal, and Communications, each with unique priorities and information.
Consequence Engine
Every decision modifies 13 organizational metrics. See how deferred security investment compounds into systemic risk.
Live Metrics Dashboard
Track cyber risk, financial health, regulatory exposure, customer trust, and ten more key indicators in real time.
Classroom Collaboration
Structured discussion prompts, guided research tasks, and real-world incident references turn every year into a rich classroom debate.
Built on published evidence
Every factual claim in the curriculum traces to a named, dated, linked source, regulator text, breach research, or a documented incident. Fictional scenario outcomes are labeled as such in the simulation and never mixed with this evidence base.
Small teams begin with CEO and CISO; as the team grows, Finance, Operations, Legal, and Communications add their own decision lens.
CEO
CFO
CISO
COO
Legal
Comms
What you will learn
Eight core competencies developed across the 15-round arc, each grounded in real incidents, regulatory frameworks, and the organizational pressures that make security decisions hard.
Risk framing
Quantify cyber risk in financial and operational terms, and communicate it to a board that controls the budget, not in CVE scores, but in ISK and hours of downtime.
Regulation
Apply NIS2 Article 21, GDPR Article 33, and DORA requirements to live incident scenarios, including governance duties and potential management-body accountability where the applicable regime and national implementation require it.
Trade-offs
Evaluate the tension between security investment and operational continuity under time pressure and incomplete information, the conditions where real decisions get made.
Compounding risk
Trace how deferred security decisions accumulate silently across years, and how a single incident triggers a bill for everything deferred, all at once.
Incident response
Navigate the first 72 hours of a breach: contain, communicate, and comply, while documenting every decision for a regulator who will review them months later.
Emerging threats
Assess AI-enabled spear-phishing, deepfake fraud, supply chain attacks, zero-day exploitation, and post-quantum cryptography risk across a fifteen-year threat timeline.
Defense architecture
Design layered technical controls, MFA, patch SLAs, network segmentation, detection coverage, that remain effective as the threat landscape evolves across 15 annual rounds.
Stakeholder framing
Justify the same security decision to different audiences: cost for the CFO, liability exposure for Legal, continuity for the COO, and reputational stakes for Communications.
Every year also includes a structured learning module, a classroom discussion prompt with role-anchored perspectives, a guided research task, and a reflection question, so the simulation doubles as a complete seminar structure.
For organizations
Also a leadership tabletop, not just a course
CyberSim was built for a university classroom, but the same mechanics run as a compact executive exercise: a leadership or security team compresses fifteen years of escalating threats into a single facilitated session, working the exact regulatory and incident evidence above instead of a hypothetical case study.
Six roles, CEO, CFO, CISO, COO, Legal, and Communications, map directly onto the seats already in your incident response plan.
Decisions are graded against NIS2, GDPR, and DORA obligations, useful groundwork for a compliance or board-reporting conversation.
The live metrics dashboard and structured debrief give a facilitator ready-made material for an after-action discussion.
I’m Dr. Stefan Bauer. I create learning simulations and courses that make innovation, entrepreneurship, cybersecurity and AI tangible. DISRUPT brings together subject knowledge, consequential decisions, teamwork and reflection.
Thinking about a learning world for your university or company? Let’s talk about your learners, your goals and how a simulation could fit.
