Training & Simulation
A security programme, a crisis plan, or an ESG governance framework that has never been tested under realistic conditions is an untested assumption. Training and simulation programmes build the human capability that turns written plans into operational reality — through crisis tabletops, physical red teaming, staff awareness, and ESG governance training designed for the specific organisation and the specific challenge it faces.
Capability is built through rehearsal — not through planning
Most organisations have security plans. Most have crisis management procedures. Most have ESG governance frameworks. Far fewer have tested them — under realistic conditions, with the people who will actually be required to execute them, in the time pressure and information environment of an actual event. The gap between what the plan says and what an organisation can deliver under pressure is discovered, reliably, at the worst possible moment.
ARRC's training and simulation programmes are designed to close that gap — not by running generic awareness sessions, but by designing exercises that are specific to the organisation's actual threat profile, its operating environment, its decision-making structure, and the specific scenarios that its risk assessments identify as credible. The scenario is realistic. The pressure is real. The findings are actionable. And the capability that is built lasts beyond the exercise itself.
Programmes span both ARRC service lines — physical security and ESG — because the organisations we work with require both. A board that cannot govern its ESG programme under regulatory scrutiny has the same capability gap as a security team that cannot manage a physical security incident under operational pressure. Training addresses both.
The value of a training exercise is not what participants learn about the scenario. It is what they learn about their own decision-making, their organisation's procedures, and the gaps between the two — while there is still time to close them.
Four core programmes
Each programme is designed and delivered for the specific organisation — its sector, its risk profile, its people, and its objectives. None is a catalogue exercise applied generically.
Crisis Management Tabletop Exercises
Facilitated exercises that test the organisation's crisis management capability — its decision-making processes, communication protocols, escalation structures, and inter-agency coordination arrangements — under a realistic scenario designed around the organisation's actual threat profile and operating context.
Physical Security Red Teaming & Penetration Testing
An independent, adversarial assessment of the organisation's physical security — conducted by practitioners who approach the facility as an informed adversary would, without access to security system documentation, and with the objective of identifying what can actually be bypassed rather than what the design assumes cannot.
Staff Security Awareness Programmes
Security awareness training designed for the specific organisation and workforce — covering the security obligations of different staff roles, the behaviours that most commonly create physical security vulnerabilities, and the reporting processes that allow staff to act as an active component of the security system rather than a passive one.
ESG & Sustainability Awareness Training
ESG governance training for boards and senior leadership, and sustainability awareness for the wider workforce — building the understanding and engagement that makes an ESG programme operational rather than documentary. An ESG strategy without an informed board to govern it and an engaged workforce to deliver it is a strategy that exists on paper alone.
Sector-specific applications
Every training and simulation programme is designed for the specific sector — because the scenarios, the stakeholders, the regulatory context, and the consequences of failure are different in each.
Data Centres
Cascading failure tabletops, physical red team exercises across multi-tier access environments, insider threat simulation, and environmental emergency response training for operations teams.
View Data Centre page →Banking & Financial Institutions
Active threat response, BCM testing against regulatory continuity commitments, insider threat simulation across branch networks, ESG governance training for boards under TCFD and BRSR obligations.
View Banking page →Manufacturing & Industrial
Emergency response exercises designed for shift-based operations, worker safety awareness in relevant languages and formats, management crisis tabletops covering environmental emergencies, and ESG governance training for senior management.
View Manufacturing page →Critical National Infrastructure
Consequence management exercises, multi-agency simulation, insider threat awareness, and BCM testing calibrated to the interdependency risks and state-level threat actors that CNI operators face.
View CNI page →Education Campuses
Lockdown drill design, evacuation procedure testing, age-appropriate student security awareness, safeguarding crisis simulation for leadership, and ESG sustainability literacy for staff and students.
View Education page →Commercial Campuses & Corporate HQ
Crisis management tabletops for C-suite, executive security briefings, staff security awareness across complex multi-building environments, incident command simulation, and board ESG governance workshops.
View Commercial page →How ARRC designs and delivers training programmes
Four stages — from understanding the organisation's specific context to the after-action findings that make the exercise investment worthwhile.
Understand the context
Before any exercise is designed, ARRC understands the organisation's threat profile, its operating environment, its existing plans and procedures, and the specific gaps or concerns that prompted the training request. The exercise design follows from the context — not from a pre-built module.
Design the scenario
The scenario is built specifically for the organisation — using its actual premises, its real governance structure, its actual regulatory environment, and the specific threat or ESG challenge that is most relevant. Participants engage with a scenario that feels real because it reflects their actual situation.
Facilitate with pressure
Exercises are facilitated in a way that introduces the time pressure, incomplete information, and escalating complexity of a real event — not conducted as a comfortable discussion of a hypothetical. The objective is to surface genuine gaps, not to demonstrate that the organisation has a plan.
After-action and follow-through
Every exercise concludes with a structured after-action debrief — identifying specific findings, specific recommendations, and specific follow-up actions. ARRC can support the implementation of exercise findings where the organisation requires continued advisory involvement.
Why ARRC for training & simulation
Three things that distinguish ARRC's training and simulation practice from generic awareness providers and consultant-facilitated workshops that produce a report without building a capability.
Designed for the organisation — not applied to it
Generic security awareness modules and off-the-shelf crisis simulation scenarios produce generic outcomes. ARRC designs every exercise from the specific context of the organisation — its threat profile, its sector, its governance structure, and the specific capability gaps that its risk assessments have identified. The exercise is recognisable to participants because it reflects their actual situation, which is the condition under which genuine learning occurs.
Security and ESG training from one practice
Organisations that require both security training and ESG governance capability building — which describes most of the organisations ARRC works with — benefit from a single practice that understands both dimensions and can design programmes that address both coherently. A board that needs to govern physical security risk and ESG compliance risk can receive both from one adviser who understands the organisation's full risk picture.
Findings that lead somewhere
The value of a training exercise is not the exercise itself — it is what the organisation does differently because of what the exercise revealed. ARRC's after-action process produces specific, actionable findings. Where the organisation requires continued advisory support to implement them — whether through security design improvements, plan revisions, or ESG governance enhancements — ARRC can provide it. The exercise is the beginning of a capability improvement, not the end of an engagement.
Design a training or simulation programme
Whether you need a crisis management tabletop, a physical security red team exercise, a staff security awareness programme, or board ESG governance training — we will discuss your organisation's specific context and confirm what a programme would involve before any commitment is made.
Initial conversations are obligation-free. Senior practitioner involvement from the first call.