The SOC Room. The breach is live.
High Tech Inc. has been hit. Ransomware has locked the business down, and The Breach Collective are enjoying themselves.
They say they only needed one set of stolen credentials to get in. Your team is the on-shift SOC. Five suspects. Five ways in. One right answer.
Somebody was helpful. Now everything's locked.
In front of you: the desk, the monitors, the phone and a filing cabinet nobody has opened since the last audit.
Access logs, phone records, internal emails, CCTV stills, social media profiles. Everything you need to trace the breach is in the room. So is everything designed to distract you.
And the hacker won't leave you alone. He pops up on the screens, taunts the team and interrupts the moment you start getting somewhere. That's what a live incident feels like. Nobody gets to think in peace.
When you think you've got it, you ring The Breach Collective. Viper answers. Name the suspect and the way in, and she might hand over the key.
Your briefing from The Breach Collective
This is the video your team watches as the shift starts. High Tech Inc. has been locked out, and Viper wants you to know exactly how little it took.
At the end of the session, she's the one you have to ring.
A working SOC, built in your space
A desk with live monitors, a landline that rings, and a filing cabinet full of the paperwork nobody shreds.
The wall of screens where the hacker keeps appearing. Sound, lighting and a countdown everyone can see.
It's the same story as our Breach escape room, built as a room you walk into.
Handover. Investigation. The call.
Every session ends with a facilitated debrief, and it always ends on the same question: who in this room would have reported it, and when?
Handover
Your facilitator briefs the shift. Viper's video plays, the ransom note goes up on the screens and the clock starts.
The investigation
Logs, records, emails, social profiles. Five suspects and the evidence to rule four of them out. The hacker interrupts on the screens whenever you get close.
The call
Ring The Breach Collective and name the suspect and the way in. Viper tells you if you're right. If not, back to the desk. Then the debrief: how did they get in, who took the call, and what was posted that shouldn't have been?
Most people have never seen a breach from the inside
They know a breach is bad in the abstract. They've never felt the pressure of a team tracing one back while the attacker watches.
The SOC Room gives them that. When they trace the stolen credentials back to a phone call somebody took in good faith, or a post that gave away a little too much, the lesson isn't "be careful". It's recognising themselves in the person who made the mistake.
It's for everyone, not the security team. Finance, HR, operations, and the exec who thinks this is IT's problem. Especially the exec.
The SOC Room has run at a global car manufacturer's HQ.
The spec
The company, the suspects and the evidence can all be rewritten around your organisation: your systems' names on the logs, your teams in the org chart, your last real near miss as the way in.
- Format
- Life-sized physical installation
- Length
- 30 to 45 minutes a session
- Players
- Up to 6 a team
- Live elements
- The hacker on the screens, and a live call to Viper
- Debrief
- Facilitated, every session
- Day
- Repeated sessions across a day
- Where
- Built at your venue, conference or HQ
- Story
- The Breach escape room, at full scale
A cyber security simulation for the people who aren't in security
The incident at floor level
Tabletop exercises are for the board and the incident team. That leaves most of the organisation with no idea what an incident feels like, and they cause and catch most of them. For the exec version, with real phones ringing and decisions that carry consequences, there's CMD.
How breaches start
Not with a genius at a keyboard. Most confirmed breaches involve a human: stolen credentials, social engineering, simple error. Somebody took a call. Somebody clicked. Somebody reused a password. The Breach story is built on exactly that.
What it should show
Whether people can tell signal from noise under pressure. Whether they talk before they act. Whether they recognise the everyday decision that let the attacker in, and whether they believe reporting early would have mattered. After a session on the SOC side, they do.
The SOC Room, answered.
What is The SOC Room?
A life-sized security operations centre built inside your venue. Your team plays the on-shift SOC during a live ransomware attack and has to trace how the attackers got in, while the hacker interrupts them on screen. It's our Breach escape room at full scale.
Who is it for?
Everyone. It's designed for a general audience, not security specialists: finance, HR, operations, leadership. It shows people who've never been inside an incident what one feels like, and how it traces back to everyday decisions.
How long is a session and how many people?
Thirty to forty-five minutes, up to six players a team, run as repeated sessions across a day with a facilitated debrief after each.
Do you need to know anything technical?
No. The evidence is logs, emails, phone records, CCTV stills and social media profiles, all readable by anyone. What's being tested is judgement under pressure, not technical knowledge.
Is the hacker real?
He's a character. He appears on the screens, taunts the team and interrupts at the worst moments. The call at the end goes to Viper, another character. Nothing in the room connects to real systems.
How is this different from CMD?
CMD is our crisis simulation for leadership and incident teams, with AI calls to real phones and branching decisions. The SOC Room is the physical experience of an incident unfolding, for everyone. Many clients run CMD for the exec team and The SOC Room for everyone else.
How is this different from The Breach escape room?
Same story, different scale. The Breach comes in a backpack and runs in a meeting room. The SOC Room is a built environment with a desk, monitors, a wall of screens, sound and lighting, with our team facilitating on site.
What does the venue need?
A room we can build in, power for the screens and, ideally, the ability to dim the lights. We scope space, power and access with you up front.
Can it be customised?
Yes. The company, suspects and evidence can be rewritten around your systems, your teams and your last real near miss. The room stays the same; the incident becomes yours.
Where has it run?
At the HQ of a global car manufacturer.
Book The SOC Room.
Tell us where and when. We'll bring the SOC.