Rehearse the cyber incident before it happens
Premalorum is a tabletop exercise for management and IT. Your team plays through a realistic incident at a fictional company. Time and money are short, and the attacker reacts to every decision.
Everyone takes on a role. Roles nobody plays are taken over by computer characters. At the end you see which decision had which effect.
- Play it in a meeting room or on a Teams call
- Invitation by link, no password
- ISO 27001 exercise record at the end
How it works
One round at the table
The scenarios are realistic incidents at a fictional company, for example a forged change of supplier bank details just before the payment run. The game is played in rounds, and every round has the same four steps.
Hand out the roles
Everyone plays a character in the company, for example the managing director, finance, accounts or IT. Roles nobody plays are taken over by computer characters.
Play cards face down
Each round, everyone plays cards from their own hand face down on the table. Every card is a measure. It costs money and ties someone up for hours.
Reveal
Then all the cards are turned over. Now the group sees what the others had in mind and where proposals overlap.
Order the plan
The managing director puts the cards in order. The money runs out at a visible line, and whatever is below it is not paid for. If nobody has time left for a card, it does not get done.
The room
What makes the exercise
You play in a meeting room or on a Teams call. The room runs in the browser, and everyone sees the same company, the same bank balance and the same clock.
A fictional company
Your team plays a mid-sized firm with its own departments, customers and suppliers. Nobody has to reveal anything about your own business.
Everyone has a role
Each character has a personal briefing and knows something the others do not. The group has to piece it together by talking.
Computer characters play along
A role without a player still plays cards, the way that role would. The characters play deliberately average. Sitting back and watching wins you nothing.
Time and money are short
Every measure costs money and ties up a person. Whoever is working on one task is not free for the next. The money only reaches the line in the plan.
The attacker thinks ahead
The attacker has a plan of their own. They react to what your team decides and when. Waiting is a decision too.
The group only learns bit by bit what the attacker is doing, from emails, phone calls and logs. What they knew all along is shown in the debrief.
Debrief
Afterwards you see what made the difference
What made the difference
The debrief replays the run and shows which decisions determined the outcome.
What the attacker knew
You see what the attacker knew in each round and what your team could not see at that point.
A look 6 or 12 months ahead
It also gives an outlook on where the company would stand in six or twelve months.
ISO 27001 exercise record as a PDF
Every exercise comes with an exercise record and a report. The record states who took part and what was exercised, and names the controls from ISO/IEC 27001:2022, Annex A, that were exercised in your run, each with its evidence. It can go into the evidence register of your ISMS. Whether it is sufficient as evidence is for the auditor to decide. You receive it as a PDF.
Into the room without effort
Invitation by link
Players open the link and enter their name and email address. They do not need a password.
Meeting room or Teams call
The team sits together or joins a call together. The room runs in the browser.
No seat stays empty
Computer characters take over roles without a player. Anyone left without a role watches as an observer.
FAQ
Frequently asked questions
What is Premalorum?
A tabletop exercise in which a team plays through a cyber incident at a fictional company. Everyone takes on a role, plays cards with measures and decides together with the others what time and money are spent on. A debrief follows at the end.
Who is it for?
For management, IT and business departments of small and mid-sized companies. It assumes no security knowledge. The cards are written in everyday language.
Do all players have to register?
No. Whoever sets up the exercise creates an invitation link. The others open it, enter their name and email address and are in the room. They do not need a password. When they join, we create a guest account for them.
What happens if not every role is filled?
Computer characters take them over and play a card each round. They play deliberately average and are no substitute for a team. Anyone left without a role watches as an observer.
Does the attacker react to what we do?
Yes. They have a plan of their own and adapt it to what your team decides and when. What they knew is shown in the debrief.
What is in the exercise record?
It states who took part and what was exercised, and names the controls from ISO/IEC 27001:2022, Annex A, that your team exercised in this run, each with its evidence. It comes with derived measures for you to fill in and a report. Whether the record is sufficient for an audit is for the auditor to decide. You receive everything as a PDF.
What does it cost?
€99 a month, or €990 as an annual membership, each per organisation, for unlimited users and exercises, plus VAT. For tailored solutions such as scenarios of your own or facilitated exercises, we will send you a quote. Write to us using the contact form.
Write to us
With questions, about tailored solutions or when you are planning an exercise. Or create an account straight away.
By email: kontakt@osyscon.de or create an account