Join the Red Team and break TRM!

Is all well in your travel risk management and ops centre?

We are building a Red Team ... and we are going to break your Travel Risk program!

... and here is how ...

🛫 We will cut the integration between your TRM platform and your HR and travel booking platforms, see if you notice

🧑‍⚕️ Over time, we will get your employees to ignore updating their profile, or add bad contact details

🙆 Let's update your travel booking tool so that it fails to properly identify and collect valid details on the person travelling and see when people disappear

⚡We would trigger a cyber attack on the TRM platform effectively taking it offline, let's see where the fallout starts

📨 Prevent emergency messages being delivered through preferred channels (such as SMS, Email, Mobile App, WhatsApp etc.) and see how you reach out now

🥲 Create completely false risk alerts based off fictitious events and include ambiguous information, how long before you spot this?

🗺️ We are going to invalidate the licenses for your mapping solution so you can't visibly see where people are

🦢 Trigger a Black Swan alert on an incident never considered or mitigated for, maybe throw in a few connected incidents and see how that stacks up

📱 We will break your platform APIs and stop any emergency mobile app from handling any panic alarms, messaging or advisory content, do employees know any emergency phone numbers?

🗞️ Introduce an incident with conflicting and contradictory alert information, what is the actual truth?

🙇 Intentionally take the key decision maker out of contact ... take away their phone/laptop and trigger a major incident, can you still decide anything?

🤖 Let's trigger a cyber incident that affects traveller's IT devices and see how you manage notifying them and replacing their devices

🔒 We will lock the doors to your GSOC, switch off the power and see how the team works around that, can you work remotely, have a backup centre or anywhere else to go?

Ok ... we are being cruel ... but in all fairness any of the above scenarios could happen and seriously impact you, your response team and your technology. You can put something in place for each of the above, but you will need to test it. Tech has become a central part of how we manage travel risk today ... but you can't always assume it is available 24/7, your team are all online and ready for action, where all data is 100% correct and your ability to reach out to those affected is simply a click away. A true resilient program takes the above seriously, considers your mitigations and plans accordingly. Are you looking at the risks of your risk technology?

Reach out and let us know your thoughts ... please challenge or add to this list. How devious a scenario can you come up with that quickly breaks any program and tests the response team in how to manage and resolve!