Cybersecurity decision lab
Four everyday security moments, two or three choices each, and what each choice leads to. Then, if you like, work through full incidents.
- Time
- About 3 minutes a scenario
- Related service
- Cybersecurity
Fictional data, run in your browser. It doesn’t connect to, scan or change any real system, and nothing you choose is sent to exQ.
Step 1 of 4
Try it in a minute
A fictional 40-person logistics company. Four everyday moments that decide how secure a business is. Choose what you’d do.
An email that looks like it’s from your bank asks you to confirm a payment through a link.
Want more? The full simulation has more settings, more scenarios and the reasoning behind every result.
Explore in more depth
Defensive and fictional: nothing here touches a real account or system.
A suspected phishing email
Someone in finance forwards an email to the service desk: “Invoice 4471 overdue, payment required today.” It links to a page asking them to sign in to view the invoice.
Evidence
Sender
accounts@supp1ier-payments.example. The real supplier uses supplier.example.
Link
Goes to login-supp1ier.example, not your organisation’s sign-in page.
Fictional evidence. Never paste real credentials or incident data into any tool, this one included.
Decisions
Decision 1
What do you do first?
Controls in this scenario
Email protection: not used yet
Filtering that catches lookalike domains, malicious links and attachments, and the ability to pull a message from every inbox.
Multi-factor authentication: not used yet
A second proof of identity on top of the password (an app prompt or a security key), so a stolen password alone isn’t enough.
Identity protection: not used yet
Watching sign-ins for risk, such as a new country or device, and being able to cut an account off fast by disabling it and revoking its sessions.
Logging and monitoring: not used yet
Recording sign-ins, changes and activity, and someone looking at it, so you can see what happened and spot it early.
Incident response: not used yet
Knowing who does what, in what order, when something happens: contain, investigate, recover and tell the right people.
User awareness: not used yet
Staff who recognise a phishing email and feel safe reporting a mistake quickly.
A tick means one of your choices put the control to work.
What the decision lab shows
Most security incidents are won or lost in the first hour, by ordinary decisions made in the right order.
Contain first, then investigate
Cutting off an attacker’s access (disabling an account, revoking sessions, pulling a message from every inbox) comes before working out what happened. Waiting for a convenient moment gives the attacker hours.
Then find out what actually happened
Sign-in logs, mailbox rules and file activity show what an attacker did. Skipping this step means missing the forwarding rule or the downloaded file, and not knowing who needs to be told.
Controls reduce risk; none removes it
Multi-factor authentication, least privilege, patching, email protection and isolated backups each close a different door. MFA can still be relayed or worn down, and a backup that has never been restored is a hope, not a control.
Fast isn’t the same as sudden
Removing everyone’s access overnight or forcing an untested update on a critical server can do as much harm as the risk it addresses. Good security work is quick on the urgent part and planned on the rest.
Every incident should change something
The most useful output of an incident is the change it leads to: MFA on every account, a call-back rule for bank details, a quarterly restore test. Closing the ticket is not the end.
What this lab is not
It isn’t an assessment, an audit or a penetration test, and its learning indicator measures decisions in a fictional scenario, not your organisation. A real review starts from your actual accounts, devices, data and people.
Discuss your security priorities with exQ.
The Lab shows the principles. Your environment, requirements and priorities decide the answer, so tell us about them. We reply to every enquiry within one business day.