what happens when security training Actually lands
Word spread so quickly we ended up with a waiting list. 97% positive feedback. 94% said they'd do it again. Makes key cyber behaviours stick.
CISO, The Telegraph
People wanting to come back matters. So does them talking about the experience afterwards. You need their attention before you can ask them to practice anything. Give them something worth engaging with and you've got somewhere to start building better security behaviours.
Why it doesn't stick
Your people aren't careless. They're just unprepared.
62%
of breaches involve the human element.
Verizon Data Breach Investigations Report (2026)
96%
of employees who took risky actions already knew they were risky.
Proofpoint State of the Phish (2024)
1.7%
average difference between trained & untrained groups after annual compliance training.
Ho et al. (2025) UC San Diego / University of Chicago
96% of employees who took a risky security action knew it was risky at the time.
That matters. Knowing the answer and acting on it are not the same thing. Traditional annual training can give people information. Human cyber risk management has to deal with what happens next, when someone is busy, distracted, under pressure or being convincingly manipulated.
A randomised study of 19,500 employees found barely any difference between people who'd completed their annual training and people who hadn't. The gap? 1.7%
So stop assuming another module is the answer. Let people rehearse the situation. Let them make the call. Let them get it wrong somewhere safe before it happens for real.
The brain doesn't learn through slides. It learns through experience, emotion and consequence. Always has.
The cost of getting it wrong
$4.99M
Global average cost of a data breach, a record high.
IBM Cost of a Data Breach Report (2026)
247 DAYS
To identify and contain a breach, the first rise in five years.
IBM Cost of a Data Breach Report (2026)
40%
Higher click rates through voice and text than through email.
Verizon Data Breach Investigation Report (2026)
$2.66M
Less per breach for organisations with an IR team and a tested plan.
IBM Cost of a Data Breach Report (2026)
How it works
Human Risk Management Training That Changes Behaviour.
Your people already know they shouldn't click suspicious links, hand over sensitive information or trust every urgent phone call.
Real incidents are harder than that. They arrive when someone is halfway through something else. The email looks convincing. The caller knows just enough. There's pressure to act quickly and no handy multiple-choice answer waiting underneath.
That's the bit we rehearse.
Our human risk management training puts people inside realistic situations and asks them to make decisions. Cyber escape rooms, AI vishing calls, digital missions, tabletop exercises and large-scale experiences all do it differently, but the principle stays the same.
If your security awareness training gives people the knowledge, we give them somewhere to use it. Somewhere safe to hesitate, question, challenge, screw it up and try again.
Because behaviour change happens in the doing.
ESC · Elementary
The Experiences
Choose Your Adventure
ESCCyber Escape Rooms
Your space. Our game. High-stakes puzzles that build instincts, spark culture change, and make security impossible to ignore.
- Best For
- Team days, culture change
- Audience
- Any team, all levels
- Players
- 5 to 250
CTRL+VISHAI Vishing Calls
Live AI-powered calls that teach your people to recognise manipulation and stay composed under pressure. Once they've felt a fake scam call, they'll never forget it.
- Best For
- Frontline & finance teams
- Audience
- Remote or in-office
- Players
- Scalable, unlimited
SPACE_Large-Scale Events
Theatre sets. Live incident simulations. Multi-team missions. SPACE_ takes over entire venues and runs hundreds of people through immersive cyber scenarios, simultaneously.
- Best For
- Events, expos & offsites
- Audience
- Company-wide audiences
- Players
- Up to 1,500 per day
^SHIFTVirtual Cyber Escape Rooms
Browser-based missions for remote teams. Fun, fast, scalable cyber learning that works anywhere. No office required.
- Best For
- Remote & hybrid teams
- Audience
- Distributed workforces
- Players
- Unlimited, anywhere
ALTAR Cyber Missions
Augmented reality and hybrid physical-cyber missions your teams can launch anywhere. Immersive, flexible, and impossible to tune out.
- Best For
- On-site & hybrid days
- Audience
- Mobile-first teams
- Players
- Flexible group sizes
CMD/Cyber Tabletop Exercises
Technical crisis simulations for senior leaders that sharpen real-world incident response. Decision-making under genuine pressure.
- Best For
- Senior leaders, exec teams
- Audience
- C-suite & incident leads
- Players
- Small leadership cohorts
From The People Who Booked Us
What People Say
The most impactful messaging we've been able to deliver - a level of impact and understanding we haven't previously achieved.
It has been critically useful to focus people's attention on the threats, and what they can do to reduce risk.
It brought to life how good security hygiene is so important and made everyone think about how they can put this into action daily.
It's not just training. It's an experience that genuinely changes behaviour.
From The Thinking Side Of The Cyber Escape Room Co.
We've Done The Reading So You Don't Have To.
The research, the framework, the book. Everything that explains why we do it this way. And why most programmes don't work.
The Behaviour Formula
Human risk isn't a people problem. It's a design problem. The Behaviour Formula is the three-lever system - Engagement, Awareness, Culture - that explains why most security programmes fail at the same stage, and how to fix it.
Explore The Framework → Research SeriesThe Data Behind The Discourse
Four papers. Neuroscience, memory science, breach economics, and the data on why annual compliance training has no measurable effect. Cited, sourced, and written for people who actually want to understand the problem.
Read The Research → The BookMay I Have Your Attention, Please?
The ultimate guide to engagement in immersive learning. Written by Amy Stokes-Waters, founder of The Cyber Escape Room Co. Covers memory, pressure, decision-making, and why most training is designed for dashboards rather than brains.
Get The Book →Built Around You
Interactive Security Awareness Training for your team
There isn't one neat format that works for every organisation. You might need a cyber security workshop for one team, a campaign across multiple locations or something immersive enough to get a room full of people properly involved.
We build around what you need people to practice. That could mean spotting manipulation, challenging an unusual request, handling a live incident or finding out what happens when a perfect sensible process meets actual pressure.
01 • Start with one experience.
02 • Build a bigger programme later.
03 • or talk to us and we'll build one for you
The important bit is that people get to do more than watch. They get to rehearse.
This is the bit where you do something about it.
Got a particular behaviour you need to work on? A team that has had enough of boring annual training? Or just feeling there has to be a better way to do this?
Come and talk to us.