THE INCIDENT
IS ALREADY
IN PROGRESS.
ALT puts your people inside a live cyber incident, on the device already in their pocket. They explore the environment, find the evidence, and make the calls. No headset. No hardware. No slides. Just decisions, with real consequences.
NOT AR.
SOMETHING
BETTER.
ALT uses your phone camera to drop participants into a 360-degree virtual environment that is already under active attack when they arrive. They move through it by moving their phone. They find the evidence. They make the calls.
There is no presenter. No narrator explaining what to look for. No signposting. The environment is the training. Every mistake the attacker made is still there to find, and every decision the participant makes has a visible consequence.
When you make the wrong call and watch the threat spread, you remember it. When you scroll through a slide that tells you not to, you forget it.
Every ALT deployment is built specifically for the organisation that commissioned it. Your environment, your risk scenarios, your brand, your people. Nothing off the shelf. Nothing generic.
HOW IT
WORKS
From access to debrief, ALT requires no facilitation, no scheduling overhead, and no specialist hardware. It runs on the device already in their pocket and can be deployed globally to hundreds of participants simultaneously.
Participants receive a QR code or a direct link from their LMS or internal comms platform. The app is branded for the organisation. No specialist hardware needed. Any standard iOS or Android device runs the experience.
A short audio briefing plays. A threat actor is already inside the network. Fault indicators glow across the environment. There is no onboarding deck. There is no tutorial. There is a problem, a clock, and a facility to investigate.
Participants physically scan the environment by moving their phone. Indicators appear on workstations, server panels, access terminals and shared workspaces. Each one is a live security scenario. Tap it, read the situation, choose a response.
Make the right call and the threat reduces. Make the wrong one and the fault spreads. Tension increases. The visible consequence reinforces the impact of the decision in real time. Cause and effect learning. Not passive reading.
The platform logs every decision made by every participant. Not just who finished. Who made the right calls, and where the gaps in your cohort actually are. Exportable. Reportable. Useful to both your security and L&D teams.
A personalised debrief arrives by email. Not a score sheet, but a narrative incident report, formatted like the kind of document a participant would write after a real event. Every decision they made. What it produced. Something worth reading on the way home.
INSIDE AN
ACTIVATION
Every ALT experience is built around a real attack chain. The following is taken from a pilot deployment built for a global manufacturing organisation: four activations forming a complete narrative arc. Entry, discovery, mistake, decision.
Production Line 4 has gone dark.
Players are dropped in mid-incident. The SCADA historian has stopped logging. Someone propped open the server room door at 02:14. No one knows if it was deliberate. That is what they are there to find out.
Working solo or as a team, they move through a 360-degree virtual version of the facility, piecing together what happened and in what order. The environment is the evidence. None of it is labelled. Players have to find it, recognise it for what it is, and act on it.
Product ALT Scenario The LockdownThe corridor outside the control room. A keypad on the door. A Post-it note on the doorframe. Not the code, but enough to find it. Three environmental clues scattered nearby. No single one gives the answer. Players have to look, cross-reference, and work it out. Wrong entries cost time. The attacker did it in under five minutes.
The production line looks fine. The HMI screen says so. But the printed shift report on the clipboard says something different. Three values have been altered in the live display. Players must compare the two sources, find all three discrepancies, and confirm every one. Partial answers do not advance the experience.
The SCADA historian recovery panel needs a login. There is a Post-it note on the underside of the terminal. Username: admin. Password: admin. The experience requires players to use those credentials to proceed. They log in through the same door the attacker walked through. The session log confirms it.
The historian confirms an active intrusion. The clock is running. Taking Line 4 offline costs six hours of production. Hot containment keeps it running but risks the attack spreading. Players who choose to keep it running watch the attack move to Line 3. Players who isolate immediately learn why containment always costs less in the end.
MORE THAN A
COMPLETION
RECORD.
ALT generates two things most training platforms cannot. Evidence of behaviour, not just attendance. And a dataset that tells you where your cohort's gaps actually are.
Every decision logged against every participant. Not pass/fail. The specific choices people made under pressure and what those choices reveal about where your real exposure is. Reportable. Exportable. Actionable.
Completion data with decision-level detail. Not just that someone sat through a module. Evidence of how they responded to the scenarios that matter most to your organisation. Something an auditor can actually use.
The brain encodes experiential decisions differently from passive information. Participants who make a wrong call and watch its consequences play out remember it. The 96% who take risky actions already know better. The problem is not knowledge, it is rehearsal.
Each participant receives a personalised narrative debrief after the experience, formatted as an official incident report, documenting the attack they just investigated and every decision they made inside it. Something they will actually read. Something they might actually share.
PILOT FIRST.
GROW
FROM THERE.
Every ALT deployment starts with a focused pilot. A small number of activations built around your highest-priority scenarios, tested with a real cohort, validated before the full platform is commissioned.
Once the pilot works, the rest follows. Same environment. Same mechanics. No rebuild required.
- Deploy to hundreds of participants simultaneously, globally, with no facilitation overhead
- Localisation support: same mechanics, multiple languages, regional regulatory context where required
- Audience expansion: general workforce through to management and executive-level scenarios
- Annual re-attestation built in, with scenario variants introduced over time to maintain effectiveness and generate year-on-year comparison data
- Modular and stackable. Start small, add new scenarios, topics and audience levels at your own pace
YOUR PEOPLE DESERVE
BETTER THAN
A MODULE.
Tell us who your audience is, what your risk priorities are, and what you need to prove. We will show you what ALT looks like for your organisation.