Decisiveness for a Real Cyber Crisis.
NeoLytik Saga puts executives and crisis teams into realistic cyber crises. AI agents translate technical events, evolve the situation dynamically, and make every decision traceable in the debrief.
Train realistically. Decide confidently. Act resiliently.
Full Data Control
Simulation data remains entirely in your own environment.
Managed AI from Germany
Only required context is processed in Germany under controlled conditions.
Certified Infrastructure
ISO 27001 and C5 certified operations in German data centers.
The Challenges
Cyber crises escalate where routine, a situational picture, responsibilities, and shared decision-making confidence are missing.
A Real Crisis Without Reliable Routine
Crisis plans exist on paper but are rarely tested under realistic time pressure. In a real crisis, routine, orientation, and trust in your own processes are missing.
Decisions Without a Clear Situational Picture
Cyber crises develop faster than reliable information. Leadership teams must make far-reaching decisions even though the situational picture, consequences, and options remain unclear and, at first, chaos and overload prevail.
Responsibilities Take Effect Too Late
Security, IT, legal, communications, and management often act side by side. Unclear responsibilities and escalation paths delay the response exactly when every minute counts.
Technology Doesn't Reach Decision Makers
Technical messages reach decision makers as jargon, isolated events, and warnings. Without understandable context, business impact and priorities remain blurred.
No one should face their first cyber crisis in production. Saga makes sure the first time happens in a controlled environment.
One Attack. Six Stages. Decisions with Consequences.
Saga makes the entire attack chain tangible – from the overlooked control gap to the operational, regulatory, and financial consequences.
Expose
A known vulnerability is not closed because responsibilities are unclear. This is how the attack often begins, long before the first alert.
Recon
The attacker deliberately searches for reachable systems, applications, and user accounts. No damage has been done yet, but potential entry points are already known.
Foothold
A first system is compromised and executes attacker commands. Rapid containment can still effectively limit further spread at this stage.
Lateral
The attacker moves through systems, expands permissions, and approaches critical assets. Every delayed decision increases the damage.
Impact
Ransomware, data exfiltration, or sabotage hit business operations. A technical incident, missing communication, and hesitant action become a company-wide crisis.
Consequence
Notification obligations, recovery, and root cause analysis begin. The debrief shows which earlier decision would have measurably changed the course of events.
The best time to stop an attack lies before the first alert: with effective controls, clear responsibilities, and practiced decisions.
How an Exercise Becomes Real Decision-Making Competence.
Every role receives its own information, makes its own decisions, and experiences their consequences – while the facilitator steers the course of events in a controlled way.
Your Own Roles, Your Own Decisions
Every team goes through the same attack in its own Lane. Roles, decisions, and consequences remain separately visible and directly comparable.
Commit Before the AI Evaluates
Participants decide for themselves first and then see the AI's assessment. This turns passive watching into active judgment.
Steer the Scenario with Control
The facilitator pauses, accelerates, and branches the campaign. New information and decision points are deliberately introduced into the room.
A Shared Situational Picture in the Room
A central view shows the progression, decisions, and impact live. This lets the entire room see what is at stake and how the situation is developing.
Technical Precision That Decision Makers Understand.
Saga combines real attack techniques with understandable interpretation. Every statement remains traceable – from the management level down to the raw event.
A Clear Picture Instead of Jargon
The AI translates technical events into understandable impacts, options, and consequences. This lets even non-technical participants take an informed part in decision-making.
Deliberation Instead of False Certainty
The AI shows what points to an attack and which harmless explanations are possible. Uncertainty becomes visible instead of being mistaken for certainty.
Evidence Instead of a Black Box
Detection rules, raw data, reasoning, and rejected alternatives remain accessible. Every assessment can be checked, questioned, and overridden.
Participants can ask the AI at any time what is happening, which assets are at risk, and what options exist. The AI answers understandably, in context, and with verifiable evidence.
Address, Assess, Conclude. Debrief.
The debrief connects decisions, consequences, and control gaps into a traceable story – without a scoring system, but with concrete improvements.
Trace Back to the Cause
The debrief traces the attack chain backward to the compliance control, decision, or responsibility that could have changed the course of events earlier.
Understand Consequences Instead of Assigning Grades
There is no artificial winning or losing. What becomes visible is which decision limited, accelerated, or unintentionally amplified which damage.
Train AI Awareness
Participants can approve AI recommendations, override them with a reason, or take over themselves. This is how responsible human oversight is practiced hands-on.
Document Progress Without Gaps
An immutable logbook captures decisions, justifications, and insights. Teams see progress and derive concrete improvements.
Saga in Practice
Experience the complete simulation cycle – from campaign control and live decision-making to the interactive debrief.
One Platform for Three Training Formats
From the board to the university: the same simulation engine, adapted to roles, organization, experience level, and the specific learning goal.
Decision-Making Ability for Leadership Teams
For boards, crisis teams, and those in charge
Boards, crisis teams, and those in charge practice business-critical decisions under time pressure for a potential real crisis. The focus is on the situational picture, communication, escalation, decision-making, and oversight.
Readiness for the Entire Organization
For security, IT, and involved departments
Companies rehearse incident response in a safe environment, on request along their own topology. Roles, processes, and escalation paths are tested realistically under crisis conditions.
Hands-On Teaching in the Lecture Hall
For universities, degree programs, and academies
Students run through their own storylines within a shared campaign. Learning progress, decisions, and reflection are supported through logbooks and assessment rubrics.
Six Campaigns. Millions of Potential Consequences.
Every campaign is based on real vulnerabilities, known attack techniques, and branching decisions. The course of events changes with every response.
Six campaigns map different attack paths and damage dimensions – from €1.8M to €800M in modeled impact.
Your Organization Becomes Part of the Simulation.
Saga maps real roles, structures, and responsibilities. As a result, teams train not in a generic scenario but in their own decision-making context.
Map Real Structures
Departments, responsibilities, access rights, and reporting lines form the basis of every simulation. Events therefore hit the actual organizational context.
Train Roles Authentically
Executives lead, security teams analyze, and departments decide within their real responsibilities. Every role receives the appropriate information and options.
Use Identities Platform-Wide
Participants use one identity and a consistent role model across Tyr, Valkyr, and Saga. Permissions and responsibilities remain centrally manageable.
Connect GRC and Simulation
Saga links the debrief with Tyr and connects identified weaknesses to compliance. This turns exercises into concrete improvements.
Sovereignly Integrated Into Your Environment
Your simulation platform stays under your control. The AI is delivered as a managed service from Germany.
Your Infrastructure
Saga runs on-premises or in your own cloud. You keep control over operations, access and all simulation data.
Managed AI Service
NeoGentic runs the AI service for you. You get powerful AI without having to manage your own models or infrastructure.
Full Data Sovereignty
Simulation and organizational data remains entirely in your environment. Only the context required for a request is processed securely.