Your training isn't working. Your environment can't afford that.
We build immersive cyber experiences for operational technology environments, designed to rehearse the decisions that matter before a real incident makes them for you.
The wall between IT and OT is gone.
For years, the air gap held. OT was separate. Different protocols, different vendors, different risk profile. That assumption is gone. The pressure to connect operational systems to remote access, vendor portals, and enterprise dashboards has accelerated. The threat has followed.
In December 2025, a threat actor targeted around 30 distributed renewable assets across Poland: wind farms, solar installations, a combined heat and power plant. The NCSC's own assessment: it was not a sophisticated attack. The actor used known vulnerabilities and weak defences, most of which could have been prevented by basic cyber hygiene. It nearly disrupted supply to over 500,000 customers.
Colonial pipeline. Ukraine's power grid. Oldsmar water treatment. In each case, the entry point was a human decision. Not a vulnerability in the OT system itself. A habit. An assumption. A password shared across systems.
The proposed baseline cyber resilience requirements explicitly note that technical controls alone are not sufficient. "Mature cyber resilience requires the implementation of controls across the people, process and technology areas of an organisation."
Reshaping Cyber Regulation in Downstream Gas and Electricity, March 2026
4
nationally significant cyber attacks on the UK every week, according to the NCSC.
Reshaping Cyber Regulation in Downstream Gas and Electricity, March 2026
204
nationally significant incidents last year, a 130% increase on the 89 handled the previous year. Nearly half were aimed directly at national infrastructure.
NCSC Annual Review 2025
95%
of UK CNI organisations have suffered a data breach. 25% only found out because the attacker told them.
Bridewell CNI Security Survey, 2025
£210K
average cost of a significant cyber attack in the utilities sector - higher than the UK-wide average of £195k.
KPMG / DSIT Economic Modelling, 2025
This isn't an awareness problem. It's a behaviour problem.
96% of employees who took a risky action (plugging in an unknown USB, bypassing a check, acting on an unverified request) knew it was risky when they did it. They knew. They did it anyway
Proofpoint State of the Phish, 2024.
Your operators aren't ignorant. They know the procedures. They can recite the policy. But it's the end of a twelve-hour shift. There's a fault on the line. A contractor is on the phone telling them it's fine to bypass the check. He's done it a hundred times.
The instinct that training was supposed to build is not there. The pause. The hesitation. The 'wait, something's off here.' It was described in a module. It was never rehearsed.
1.7%
the difference mandatory annual training makes to behaviour.
Randomised control study. Ho et al. 2025. UC San Diego / University of Chicago.
86%
reduction in phishing susceptibility with continuous immersive training over 12 months.
KnowBe4, 2025. 14.5M users. 67.7M simulated phishing tests.
5 Years
how often the US Army now requires mandatory cyber training
US Army's analysis of training, March 2026.
You cannot train instinct by describing it.
Think about how pilots train. They don't watch videos about turbulence. They use simulators that put them in it. Repeatedly. Until the right response stops being a decision and starts being a reflex. That's what we build.
Engagement
Earn attention from people who think they've heard it all. Your operators are technically experienced and probably sceptical of anything that looks like corporate training. We build experiences that make them pay attention because something is actually happening.
Culture
Normalise the behaviour across the shift, not just in the session. Culture doesn't form in the training room. It forms in the conversations afterwards. In the shared language. In the "remember when we nearly missed that." That's what makes behaviour stick.
Instinct
Make the right call fast enough to matter. At 2am. With a fault on the line. When the information is incomplete and a contractor is telling you it's fine. Instinct isn't taught, it's rehearsed. Repeatedly. Under pressure. Until it runs without instruction.
An escape room. Really?
Fair. It's a legitimate challenge. So let's be direct about what we're not claiming.
We're not claiming our approach replicates a real incident. The systems aren't real. The people aren't real. Nobody's pipeline is actually offline. You do need to use a bit of imagination.
What we are claiming is that the cognitive and behavioural conditions it creates are real. When the clock is running and the information is incomplete and your team needs to communicate clearly and someone is making an assumption that takes you in completely the wrong direction. That is not a metaphor for an OT incident. That is structurally identical to one.
What we've learned from running this with utlities, energy and CNI teams:
People don't reveal how they behave under pressure in a classroom. They do reveal it with us. The person who goes quiet under pressure. The person who skips the verification step because they're confident they know the answer. The person who notices something is wrong but doesn't say it because they assume someone else has already clocked it.
Those behaviours don't show up in compliance training. They show up here. And once you've seen them, you can work on them. Which is the entire point.
Build for operational
environments.
Your team walks into a live cyber incident. CCTV is down. The local equipment room is locked. Critical machinery has gone offline.
You're the on-site response. Physical clues. Partial information. A lock.
The attack vectors aren't invented. They're the same entry points that have taken down real OT environments. And the same ones cited by the Ogfem and DESNZ consultation as the top attack avenues for OT: not zero-day exploits, not nation-state tradecraft. Cloud services. Web browsing. Human decisions, made a hundred times a day, by people who do know better.
What we're watching for, and what we want your team to notice about themselves, isn't whether they solve the puzzle. It's how.
Session Details
The regulator is asking about the human layer.
Trusted by OT & critical infrastructure teams
The Cyber Escape Room experience was a game changer for our security awareness training. Our teams were fully engaged. Participants described the sessions as 'actually fun', something you rarely hear about cyber security training. It's not just training. It's an experience that genuinely changes behaviour.
Sally Bolton, Cyber Human Risk Manager
Scottish Power Energy Networks
The training hasn't changed. Let's fix that.
If you're responsible for human risk in an OT or critical infrastructure environment, and you're asking whether your current programme is doing what it needs to do, we want to have that conversation.