Castle Security Services
The largest cyber crisis simulation in the Southern Hemisphere
More exercises. Smaller team. No compromise on quality.
Castle is a Brazilian cyber security consultancy that helps organisations understand how they would actually respond to a cyber crisis. They use B-Ready, their proprietary simulation methodology, to approach cyberattacks as business problems, not just technical ones. As their exercise programme grew, so did the operational overhead. This case study looks at how they used Conducttr to keep pace without adding headcount or cutting corners on quality.
About Castle
Castle is a tactical and strategic cyber security consultancy focused on transforming security into a business enabler. Their exercises treat cyber crisis as business continuity issues, revealing real gaps in processes, governance, and cross-functional coordination. B-Ready combines tabletop elements with role-playing game dynamics and game theory to create dynamic, ambiguous, realistic scenarios. Castle also supports clients during live incidents, feeding practical field experience back into exercise design.
Márcio Sá, Founder and Managing Partner
“Conducttr has significantly elevated the level of our crisis management and incident response exercises. We can now scale delivery while maintaining consistency and quality. Today, our team is less focused on operations and far more focused on what truly creates value for our clients: narrative, decision-making, and effective learning under pressure.”
Challenges and Solutions
B-Ready exercises run across multiple channels simultaneously: simulated media, regulatory pressure, supplier communications, and incomplete information. That depth has a cost. The more ambitious the scenario, the more people it took to run it. Increasing volume meant either adding resources or accepting lower quality. The specific pressure points: manual coordination of timelines and injects, printed briefing packs, limited flexibility once exercises were live, larger ExCon teams for larger scenarios, and difficulty adapting the same scenario for different audiences without rebuilding from scratch.
B-Ready exercises are designed to replicate the complexity of real-world cyber crises. Participants must simultaneously deal with executive pressure, media scrutiny, regulatory engagement, supplier communications, operational disruption, and incomplete information: all while making time-critical decisions. As Castle expanded its cyber resilience practice, a key challenge emerged: how to scale exercise delivery without diluting realism or proportionally increasing the number of delivery teams. Historically, scaling cyber crisis exercises meant scaling Exercise Control (ExCon) teams as well. Larger and more complex scenarios required additional facilitators to coordinate timelines, manage injects, simulate stakeholders, distribute participant materials, and adapt the exercise in real time. As demand for B-Ready grew, the challenge was not simply to deliver more exercises, but to do so without compromising the realism, narrative depth, and decision-making pressure that define the experience.
B-Ready exercises are designed to replicate the complexity of real-world cyber crises. Participants must simultaneously deal with executive pressure, media scrutiny, regulatory engagement, supplier communications, operational disruption, and incomplete information: all while making time-critical decisions. As Castle expanded its cyber resilience practice, a key challenge emerged: how to scale exercise delivery without diluting realism or proportionally increasing the number of delivery teams. Historically, scaling cyber crisis exercises meant scaling Exercise Control (ExCon) teams as well. Larger and more complex scenarios required additional facilitators to coordinate timelines, manage injects, simulate stakeholders, distribute participant materials, and adapt the exercise in real time. As demand for B-Ready grew, the challenge was not simply to deliver more exercises, but to do so without compromising the realism, narrative depth, and decision-making pressure that define the experience.
Solution: Build once, run for any audience
Castle uses Conducttr to build and run exercises from one place. Scenarios are created in the Scenario Editor — timelines, injects, and participant content set up in advance. During the exercise, facilitators use Exercise Control to trigger injects, impersonate stakeholders, and adjust pace in real time. Participants receive emails, messages, social media posts, news feeds, and alerts through Conducttr's virtual desktop, mirroring their real working environment. Role-specific content means technical teams and leadership run simultaneously within the same exercise. No rebuilding from scratch for each audience. The Pattern of Life feature keeps the simulated world credible between injects. The impersonation feature lets one ExCon operator respond as multiple named stakeholders. LISA, Conducttr's AI Crisis Architect, supports scenario development throughout — generating scenario concepts, inject content, personas, and images in minutes using the Active eXercise System.
Results
The clearest example is Guardião Cibernético, the largest cyber crisis simulation in the Southern Hemisphere. In one three-day event, Castle delivers around six large multi-stakeholder exercises, all on Conducttr, managed by a small ExCon team. Across their wider practice: preparation time is down, exercise volume is up, scenario quality has improved because time saved on operations goes back into narrative, and the same scenario structures are reused across clients without rebuilding. Conducttr gives Castle the operational control to scale delivery while protecting the realism that makes their exercises worth running.
The combination of B-Ready and Conducttr has significantly increased Castle's ability to deliver high-quality cyber crisis simulations at scale. By reducing preparation effort and operational overhead, facilitators can focus more on what creates value for participants: richer narratives, more realistic stakeholder interactions, and stronger learning outcomes. The strongest example is Guardião Cibernético 2025 (EGC 7.0), the largest cyber crisis simulation initiative in the Southern Hemisphere, where Castle delivers multiple large-scale, multi-stakeholder exercises over a week-long event using a lean ExCon team and a single Conducttr-powered environment.
This scalability has been a key driver of Castle's growth over the last three years. With Conducttr providing the operational foundation, Castle has delivered more than 65 cyber crisis simulations involving over 1,400 participants across financial services, aviation, mining, healthcare, retail, energy, logistics, and technology sectors. The ability to consistently increase delivery capacity without compromising realism or quality has helped establish Castle as the leading cyber crisis simulation provider in Brazil, trusted by some of the country's largest and most critical organizations.
The combination of B-Ready and Conducttr has significantly increased Castle's ability to deliver high-quality cyber crisis simulations at scale. By reducing preparation effort and operational overhead, facilitators can focus more on what creates value for participants: richer narratives, more realistic stakeholder interactions, and stronger learning outcomes. The strongest example is Guardião Cibernético 2025 (EGC 7.0), the largest cyber crisis simulation initiative in the Southern Hemisphere, where Castle delivers multiple large-scale, multi-stakeholder exercises over a week-long event using a lean ExCon team and a single Conducttr-powered environment.
This scalability has been a key driver of Castle's growth over the last three years. With Conducttr providing the operational foundation, Castle has delivered more than 65 cyber crisis simulations involving over 1,400 participants across financial services, aviation, mining, healthcare, retail, energy, logistics, and technology sectors. The ability to consistently increase delivery capacity without compromising realism or quality has helped establish Castle as the leading cyber crisis simulation provider in Brazil, trusted by some of the country's largest and most critical organizations.
Continuous Improvement
To further improve scalability and consistency, Castle developed BSC( B-Ready Scenario Compass), an internal B-Ready preparation platform that supports the entire exercise design process, including cyber resilience assessments, crisis committee behavioral analysis, scenario development, and storyboard creation. This structured approach reduces preparation effort while improving the quality and consistency of each exercise. The platform integrates directly with Conducttr, generating and transferring the initial inject set used during simulations. Early results have already shown gains in efficiency, productivity, and scenario quality, with further optimization expected as the platform continues to evolve.