CyberSim

A cybersecurity tabletop exercise

Cybersecurity is what happens while you’re making other plans.

CyberSim helps teams experience cybersecurity tradeoffs while they pursue the real-world goals that brought them into the room.

Talk with us
  1. 5 minutes in

    You hold a campaign rally.

  2. 8 minutes in

    A hacker steals your email.

  3. 12 minutes in

    Leaks lead to bad press; you drop 10% in the polls.

A safe place to have a very bad day.

Why it’s different

Most training describes the threat. CyberSim makes you feel it.

Most cybersecurity training hands people a list of threats to memorize. CyberSim does the opposite: it drops your team into a familiar, fast-moving job and lets the consequences of their choices play out in real time — safely, in a fictional world where it’s fine to lose.

This approach works because almost no one is thinking about cybersecurity until it impacts their real work. Imagine a volunteer rage-quits and no one cuts off his access in time — now it’s a data breach. Someone skips two-factor to save a little time and headache — sooner or later, a password compromise. The lessons stick when routine decisions quietly turn into a crisis.

How it works

An hour of pressure, played out on the table.

CyberSim runs as an in-person tabletop exercise, powered by a digital facilitator’s app and projected for the whole room. Over a single fast-moving hour, your team chases a real-world goal while a steady stream of cyber disruptions complicates almost everything they’re trying to do.

Players don’t need to be security experts, and most aren’t. They make the calls under time and money pressure, and the facilitators keep score in plain view.

When the clock runs out, the real teaching begins. In the after-action review, the group walks back through the session together — every breach, near-miss and lucky escape — and the facilitators turn what just happened into the cybersecurity habits that would have changed the ending.

Five scenarios

Built to match your organization's day-to-day.

Players aren’t dropped into a generic data breach. Each scenario mirrors the pace, priorities and limited resources of work they recognize.

Election campaign

You're on the campaign of a presidential challenger — running rallies, ads, fundraising and voter outreach — while cyberattacks keep interrupting the race.

Explore

Civil society and nonprofits

Staff and grassroots volunteers build public support for a voting-rights referendum while outside threats jeopardize the campaign — and the community.

Explore

Parliaments and legislatures

MPs, officials and staff work to keep parliament's approval up and pass critical legislation as adversaries try to drag a young democracy backward.

Explore

Election observer teams

A nonpartisan observer network races to recruit, train and deploy enough monitors — and guard its data — before a contested election day.

Explore

City and local government

City staff build resident confidence behind a major infrastructure bond — lawful public education, not campaigning — while cyberattacks threaten the city's credibility.

Explore Don’t see your sector? CoCitizen can design a scenario for your organization.

CyberSim is especially useful for funders, networks, and support organizations that need a memorable way to help many partners build practical cyber judgment.

Bring it to your team

What it takes to run CyberSim.

CyberSim is a facilitated, in-person event. Here’s what to plan for.

Plan for a half-day

The simulation itself is a fast, frantic hour — but the full session, with setup and the debrief, runs at least half a day.

Two or three facilitators

Facilitators keep the pressure on during play and lead the conversation afterward. Three works noticeably better than two.

A room and a screen

An in-person space, a projector or screen for the live dashboard, the facilitator’s app, and eight to eighteen players.

The debrief is the point

Afterward, the group walks back through the session — which bullets they dodged, which they walked into, and the cybersecurity lesson behind each.

Safe to run, without the jargon

CyberSim uses fictional scenarios and does not require access to your real systems or sensitive data. The debrief turns what happened in the game into plain-language habits around account access, MFA, phishing, incident escalation, and data protection.