Strategic and Crisis Advisory
A controlled simulation that measures whether somebody who notices can get that to a person who can act, and how long it takes. Nobody is named, and nobody faces a consequence for clicking.
Click rate is the number everybody reports and the least useful one available. Given enough attempts everybody clicks, including the people who wrote the policy.
The number that decides an incident is whether the person who noticed could reach somebody who could act, and how long that took. Most organizations have never measured it.
How many people got it to somebody who could act. This is the control, and it is the number the report leads with.
Compared against what containment would have needed. If the first report arrives at 47 minutes and an attacker needs 20, that sentence is the finding.
The most encouraging result available. Admitting a mistake immediately is harder than avoiding it, and it is the behaviour that contains a real incident.
A report is only useful if it reaches somebody who can act on it inside the window that matters.
Where the route ends in a shared mailbox nobody watches out of hours, that is the finding, and it is a process failure rather than a people failure.
No individual is identified in any output, and nobody faces a consequence for clicking.
A simulation people fear is a simulation that trains them to hide, which is the opposite of what you are trying to build.
Most simulations sell a click rate and a training module. The click rate falls, everybody is pleased, and nothing has been established about whether the organization could respond.
Here the measurement is the reporting path end to end: did somebody notice, could they report, did the report reach a person who could act, and how long did that take. Clicked then reported is counted as a success, because it is one.
And nobody is named. Not in the report, not to their manager, not ever. The output describes the organization, because the organization is what you can change.
Time to first report changes how an incident goes. Click rate does not, and everybody clicks eventually.
Where reporting fails it is almost always a path nobody maintains. That is a cheap structural fix rather than an endless training spend.
A simulation that punishes clicking teaches people to stay quiet, and silence costs more than any click ever has.
Customers and insurers ask what you do about people. A measured reporting rate is an answer; an annual course is an activity.
You tell us what prompted the question. A customer questionnaire, an insurer, a board, or a date somebody gave you.
Thirty to forty-five minutes establishing what applies to you and what does not. Not charged, and not a sales call: if the answer is that you need less than you thought, or somebody else entirely, we say so.
What is in, what is out, what you have to supply, the fee and the end date. Nothing starts until you have it in writing.
Delivered against that scope. If something has to change, we agree it in writing first, including what it costs.
The deliverables, plus the evidence and the method, so the work can be repeated by somebody who is not us.
Fixed fee against an agreed scope. Nothing is billed hourly and the scope does not move without your written agreement. The fee is quoted rather than published, because a number carrying an asterisk is worth less than a straight answer, and scope is what decides it. You own the output. Editable files, no platform, no license, no lock-in.
Reporting rate, time to first report, and how many people clicked and then reported anyway. Click rate is recorded and it is not the headline, because given enough attempts everybody clicks.
No. No individual is identified in any output, ever. If your organization wants to name people, this is the wrong supplier.
It is written to your environment and your suppliers, at a difficulty agreed in advance. A simulation nobody could plausibly fall for measures nothing, and one designed to catch everybody measures only that it was designed to.
Where reporting fails, the fix is usually a route rather than a course. We say which it is instead of selling the same module either way.
Name individuals, report to managers on people, or run it without written authorization from somebody entitled to give it.
If you do not currently know your time to first report, that is the answer. Establishing it once gives you something to improve against and a number the board can compare next year.
Related services: Incident Response Tabletop Exercise · Incident Response Planning and Readiness · Security Health Check