.jpg%3Fv%3D1793691779708&w=3840&q=75&dpl=dpl_HJhMvQXaidWP7dT5TicQifqWmxpu)
Critical infrastructure
Operational resilience you can prove.
Outcomes
When the system fails,
procedure is not preparedness.
Disruptions don’t stay in one place. A continuity plan walked through in a boardroom never recreates the tension between the control room, the field and the executive.
- Control room to boardroom
- A crisis plan doesn’t make crisis decisions. People do. Exercise executives, operators, cyber teams, communications, legal and partners at once. See how they prioritise, escalate and decide as the consequences compound.
- Fail safely
- Critical systems can’t afford to learn through failure. Put leaders, operators and partners through cyberattacks, infrastructure failure, supply-chain disruption and cascading consequences. Safely.
- The plan meets reality
- Plans are written in calm rooms. Crises aren’t. Pressure-test continuity, incident response and recovery plans with the people who run them. Expose conflicting assumptions, unclear authorities and hidden dependencies.
- Safety against speed
- Pressure to restore supply grows by the hour. The people in the control room are also responsible for crews in the field. Practise the trade-off before you have to make it.
- Ready for the regulator
- Show more than compliance. Show capability. Evidence of how teams performed against plans and obligations. Defensible insight into gaps, improvements and investment priorities.
Scenarios we run
Built around
your network.
Your assets, your geography, your obligations. Control rooms, operational leads and executives in one exercise.
Operations
Cascading failure
A fault in one network spreads to others. Then it takes down the communications the response depends on.
Cyber
Cyberattack on operational technology
Control systems behave strangely. Fault or attack? Operators decide before they know.
Weather
Extreme weather damage
A storm brings down transmission lines across a region. Crews can’t reach them yet.
Reputation
Executive and regulatory response
Executives and corporate affairs brief the board, meet reporting deadlines and front the media through an extended disruption.
Market
Fuel supply disruption
Imports delayed. Stocks falling. Who gets supply first?
Operations
Statewide blackout
The whole system goes dark. Restart it island by island, with hospitals and water pumps waiting.
People
Insider threat
A trusted employee with system access, and a reason to use it.
Fire
Bushfire at the asset
Fire approaches a substation, pipeline or depot. Protect it, or pull people out?
Geopolitical
A dormant intruder
A state actor found inside your control network, waiting. Remove them now, or watch?
Health
Water contamination
A supply is compromised. Boil-water notices to a whole city.
Operations
Safe restoration
A severe regional outage. Conflicting reports, hazardous conditions, and growing pressure to restore supply.
Technology
A faulty software update
A routine vendor update crashes thousands of machines at once. Nothing malicious. Everything down.
Weather
Record demand
A 45-degree evening and not enough supply. Shed load, and decide whose power goes first.
Cyber
Ransomware on IT systems
Billing and customer systems encrypted. Operations must keep running.
Flood
Major asset failure
Structural concerns at a dam or critical asset. Communities downstream.
Market
Supplier and contractor failure
Primary suppliers or specialist equipment delayed or unavailable. Single points of failure exposed.
Geopolitical
Undersea cables cut
Two international cables fail in a week. Traffic reroutes, latency climbs, and no one will say why.
Technology
Telecommunications outage
A national network fails. Emergency calls are at risk.
People
Workforce disruption
A pandemic or industrial action takes out key operators.
Reputation
A rumour about the water
A post claims the supply is poisoned. It spreads faster than the test results.
Operations
Physical incident
Damage at a critical site, and no clear cause yet.
Flood
Flooded substation
Water rising at a zone substation. De-energise now and cut thousands, or wait for the peak?
Cyber
Hospital ransomware
A hospital network locked mid-shift. Pathology, imaging and records go dark.
Market
Winter gas shortfall
A cold snap and a plant outage. Not enough gas for both homes and power stations.
Operations
Drones over a substation
Seen at night, three nights running. No one knows whose they are.
Technology
Payments stop
Card payments fail nationwide on a Friday afternoon. Shops close, and customers can’t reach their money.
People
Control room evacuation
A fire alarm in the primary control room. Move to the backup site and keep the network running.
Cyber
Customer data breach
Customer records for sale online. The clock on mandatory notification is already running.
Weather
Solar storm
A severe geomagnetic storm. Transformers at risk, and GPS timing starting to drift.
Technology
Data centre failure
Cooling fails during a heatwave. Every client in the hall goes down with it.
Operations
Port closure
A major port shuts without warning. Fuel, freight and medicines wait offshore.
Track record
Exercises built for
essential services.
How it works
Foresight: the flight simulator for essential services.
Pilots don’t prepare for emergencies by talking about them. They get in the simulator. Your operators and executives need the same: the pressure of a real outage, with nothing touching live systems.
01 / 04
Design
Build your exercise around your assets, your geography, your safety thresholds and your continuity plans. Ready in hours, not weeks.
02 / 04
Deploy
Control room, field and executive go live on Foresight, in one exercise. Agentic AI actors play the regulators, customers, journalists and contractors pushing back. Every decision changes what happens next.
03 / 04
Debrief
You decide what matters. Hindsight measures it. Each order, clearance and public notice against what was known at the time. Time to escalate. Time to notify the regulator. Start from a ready-made package or build your own.
04 / 04
Develop
Every gap becomes a corrective action, with an owner and a date. Run it again. Watch the numbers move.
Built for
Your roles.
Your obligations.
Built for
- Control-room operators
- Dispatchers
- Field supervisors
- Operations leads
- Cyber teams
- Executive team
- Corporate affairs
- Board
Aligned with
SOCI Act- SOCI Risk Management Program rules
- AESCSF
- APRA CPS 230
NIS Regulations- NCSC Cyber Assessment Framework
- UK Government Resilience Framework
NIS2- Critical Entities Resilience Directive
- DORA
CISA Cross-Sector Cybersecurity Performance Goals- NERC CIP
- IEC 62443
- ISO 22301
- Business continuity plans
- Safety thresholds and procedures
Sectors we serve
11
Energy
Two substations trip on the hottest day of the year.
Water and sewerage
A supply is contaminated. A city on boil-water notice.
Communications
A national network fails. Emergency calls are at risk.
Transport
A port shuts. Freight backs up across the country.
Health care and medical
Ransomware hits a hospital network mid-shift.
Financial services and markets
Payments stop. Customers can’t access their money.
Food and grocery
Distribution centres go dark. Shelves empty in days.
Data storage or processing
A data centre outage takes clients down with it.
Defence industry
A supplier is compromised. Classified programs exposed.
Higher education and research
Research data stolen. Foreign interference suspected.
Space technology
Satellite services degrade. Navigation and timing drift.
Secure by design
Built for sensitive work.
- SimulatedNothing touches live systems.
- ConfidentialNetwork, asset and vulnerability data stays protected.
- Every levelControl room, field and executive together, in the room or remote.
- Fits your frameworksContinuity plans, safety procedures and SOCI obligations.
Our technical team works with yours to meet your security requirements.
Request a briefing
Which failures does your team need to practise?
Tell us about your network and the disruptions you plan for. We’ll show you how a first exercise would run.