When a cyberattack spoils the stock
Could someone change our refrigeration controls, and would we detect and contain it before stock is lost?
Part 1 · assessment and mitigation recommendations · published v1.0 · 14 October 2026
Start with what happened.
Show why it matters.
Test the barriers.
Real-world incidents make the business risk concrete. Each playbook connects that evidence to relevant systems and people, reusable attacker routes, approved tests, measurable outputs and recommendations that reduce likelihood or impact.
Part 1 Library: 11 sourced real-world examples · 10 reusable vector guides · 33 scenario assessment steps. One example is explicitly a research demonstration; one is an accidental-loss case. Client-specific attack paths are labelled proposals. No client results or scores are invented.
Real incidents → relevant business risks
A convincing support request opens the customer database
Can an impostor turn contact with our staff or support provider into access to customer records?
The invoice is plausible. The bank account is wrong.
Would our payment process stop a convincing but unverified supplier or executive instruction?
An overlooked web page exposes customer records
Could a forgotten page, unsafe query or broken role check expose another customer’s information?
A cloud permission error becomes a data breach
Could an exposed application, leaked build secret or excessive cloud role reach data it should not?
Guest connectivity becomes an internal-network route
Can a guest, nearby device or misleading WiFi login cross into business access or capture sensitive interaction?
The business stops when supporting IT stops
Which digital dependency could halt our operation, and can we contain an incident and restore essential work?
A supplier outage interrupts essential services
Can we maintain critical work when a trusted supplier’s systems or data exchange become unavailable?
A phone compromise exposes confidential work
Are sensitive mobile users adequately protected, and could we preserve and assess evidence if compromise were suspected?
An AI assistant treats hostile content as an instruction
Can untrusted content make our assistant expose another customer’s data or request an unauthorised tool action?
A lost device or physical-access gap exposes useful information
Could someone obtain sensitive information or access through a lost device, visitor process or unattended workspace?
Independent audit brief: all 11 cases and evidence requirements →
One reusable method, many scenarios
A scenario references a vector such as phishing, MITM or an evil portal. The vector references the Armory and maintained tool guidance, then the specific Repository inputs. Target Management provides the current rules for this use. Evidence returns to the scenario so the client can see which business risk was tested and what the results mean.
| Layer | Open |
|---|---|
| Attack techniques | 10 reusable vector guides |
| Common assessment work | Scope, intelligence, preflight, channels, evidence and reporting |
| Outputs and measures | Step-result template · Part 1 report outline |
| Existing tools and resources | Live Armory ↗ · Live Repository ↗ |
Stop point: mitigation recommendations and how their effectiveness could later be verified. The implementation action plan, work allocation, scheduling, packaged service offering and pricing are deferred.
Published guidance does not grant campaign approval. These links do not launch tools, contact people or change the live campaign system.