The Break In
CCTV is down. The Local Equipment Room has locked itself out. The PLC isn't responding. You're the on-site response team - and a live SOC is waiting on WhatsApp for your first update. No warm-up. No hand-holding. The clock is already running.
No Warm Up. No Hand Holding.
You're the on-site information security team at Planet Energy's Facility 8 - one of the most sensitive energy facilities in the country. Ten minutes ago, something went wrong in Local Equipment Room 3. CCTV went offline. The PLC stopped responding. The access codes were changed overnight.
It might be nothing. A power blip. A maintenance glitch. But The Breach Collective have been targeting energy companies, and this doesn't feel like nothing.
Your job is to get into the LER, assess the damage, communicate with the SOC, and stabilise the environment before this becomes a full-blown outage with very real consequences. The SOC is live on WhatsApp. They'll guide you, challenge you, and ask questions you need to be ready to answer.
This isn't a classroom exercise. The incident is already in progress.
What your team takes away
The Break In covers the full stack of OT security failures - from weak passwords on physical access points to default credentials on critical systems. Every mistake in the game reflects real world mistakes that cause real incidents in real facilities.
The soc is
live on
whatsapp.
Every other escape room ends at the props on the table. The Break In doesn't. From the moment your team makes contact, a live SOC thread opens on WhatsApp... and it stays open for the duration.
Ash from the SOC asks questions your team needs to answer accurately. Shares intel at the right moment. Challenges assumptions. And if your team skips the contact step and charges ahead, the consequences arrive later..
Action without communication equals consequences. That's not just a game rule. It's the central lesson of every OT incident that has ever escalated beyond what it needed to be.
The only scenario Build for industrial environments
The Break In is the only ESC scenario built specifically around operational technology and industrial control systems. The setting isn't incidental... it's the point. The scenario puts players in the role of an on-site response team at a critical national infrastructure facility, facing the kind of incident that OT security professionals spend their careers preparing for.
The puzzles, the OSINT trail, the physical security failures, the default credentials on the PLC... every element maps directly to the attack vectors that have caused real outages in real energy, utilities, and industrial facilities. The Break In is used by organisations who need their operational teams to understand what a cyber-physical incident actually looks and feels like under pressure.
It's also the scenario that generates the most post-session conversation among technical teams, because the attacker's route through the facility is disturbingly plausible.
Energy & Utilities
Power generation, grid operators, water treatment. The core audience for this scenario.
Manufacturing & Industrial
Facilities with ICS, SCADA or PLC environments where cyber-physical risk is real.
Healthcare & Critical Infrastructure
Any sector where operational downtime has direct safety or service consequences.
Oil, Gas & Nuclear
High consequence environments where incident response capability is a regulatory requirement.
Transport & Logistics
Infrastructure operators where physical and digital security are deeply interconnected.
built for teams with real stakes
OT & ICS Security Teams
The primary audience. Engineers, operators, and security professionals in industrial environments who need to rehearse incident response in a way that feels real.. without the consequences of a real incident. The scenario is technically credible enough to challenge people who know their stuff.
On Site Operational Teams
The people who would actually be first on the scene during an OT incident... not always security specialists, but the team expected to respond. The Break In gives them an experience of what that looks like before the real thing happens.
Cross-Functional Security & Operations
Running The Break In with a mixed team, security alongside engineering alongside operations management, creates the shared language and incident response instincts that make real-world response actually work. Siloed teams who've never practiced together find this scenario particularly revealing.
Leadership with OT Responsibility
Senior leaders overseeing critical infrastructure need to understand what a cyber-physical incident feels like under pressure, not just what it looks like in a post-incident report. The Break In is the most effective way to make that visceral rather than theoretical.
The numbers that matter
45min
duration
Plus 15-20 minute facilitated debrief. Back-to-back rotations available for larger groups.
4
players per team
Minimum 2. Optimal at 4. Multiple kits can run simultaneously for bigger events.
1table
space required
A standard meeting room table is all you need. Wi-Fi required for tablet and SOC interaction.
20min
setup time
We handle everything. You arrive to a room that's ready to go.
50+
people in a day
With back-to-back rotations across multiple kits. We'll help you plan the logistics.
3
delivery options
Facilitated, Kit Hire, or Long-Term Rental. Details below.
choose your delivery format
facilitated sessions
We set everything up and run the full session. Our facilitators manage the interaction in real time - keeping the pressure on, guiding the narrative, and delivering a structured debrief at the end.
Kit hire
We ship you the complete kit including the tablet. You run the session using a pre-configured SOC thread. We'll brief you fully on setup so you're confident before your team walks in.
long-term rental
Keep the kit year round for ongoing incident response rehearsal. Swap to different ESC scenarios throughout the year to cover different security topics without repeating the same experience.
The games weren't just entertaining; they were a powerful tool for driving home critical security messages. We saw people discussing password managers, understanding social engineering risks, and becoming more cyber-aware. It's not just training - it's an experience that genuinely changes behaviour.
⎯ Cyber Human Risk Manager, Scottish Power
Things people usually ask
Do players need OT or ICS knowledge to participate?
No technical prerequisites required. The scenario is designed to be accessible to anyone on an operational or security team.. from seasoned ICS engineers to general security awareness audiences. The OT context adds realism and urgency without requiring specialist knowledge to engage with.
How does the live SOC WhatsApp thread actually work?
The SOC thread runs via WhatsApp and is pre-configured to guide teams through the key interaction points of the scenario... authenticating the team, sharing intel at the right moments, and applying pressure when things go quiet or steps get skipped. The consequences of ignoring the thread are built into the game.
Why only 4 players instead of 5?
The Break In is more complex and more tactically demanding than the other ESC scenarios. At 4 players, teams are stretched enough to feel real pressure without having spare hands that dilute the urgency. It also mirrors realistic on-site response team sizes in most OT environments
Can it run without Wi-Fi?
No. The tablet and the SOC WhatsApp thread both require a Wi-Fi connection. We recommend using a guest network where possible. If your facility has strict network policies, get in touch and we'll work through what's needed.
How does this count towards compliance and regulatory requirements?
The Break In supports requirements under IEC 62443, NIS2 (Articles 20–21), DORA (Article 13), ISO 27001 (Clauses A.6.3, A.7, A.8), and NIST CSF 2.0. It's particularly well suited to organisations subject to CAF (Cyber Assessment Framework) requirements. We can provide documentation for your audit trail.
How does this compare with other ESC scenarios?
The Break In is the most technically complex and sector-specific of the four scenarios. It's the only one with a live digital element (the SOC thread and tablet) alongside the physical kit. If you're looking for a general workforce scenario, The Breach or The Heist are better starting points. The Break In is built for operational teams who face real cyber-physical risk.
Explore the Full Range
Flip the script. You're playing the attackers. A CEO's lost rucksack, a digital footprint wide open - exploit everything you can find and pull off the ultimate heist.
A ransomware attack. Five suspects. Five compromise paths. Crack the case, call the hackers live, and earn the decryption key before the clock runs out.
Victorian espionage. Modern lessons. Step into Sherlock's office to uncover who stole the factory blueprints - ciphers, contraptions and a suspiciously clever origami puzzle that brings encryption to life.
Let's Book The Break In
Tell us your team size, your location, and your rough timeline. We'll come back to you with everything you need to make it happen.