Anyone entering the security lab on the seventh floor of Fraunhofer FOKUS in Berlin is immersed in a virtual chamber of horrors featuring ransomware attacks, data theft, and compromised user accounts. Using a fictional company as an example, the SIRIOS Lab shows how an IT security emergency develops step by step, which vulnerabilities are exploited, and what decisions employees must make in a crisis.

Cyber Threats in Everyday Work

Cyberattacks often begin inconspicuously, and their consequences can include system failures, operational disruptions, confidential data leaks, and significant legal and financial damages. In the SIRIOS Lab, participants can track a cyberattack's progression from multiple perspectives.

Participants experience both the attacker’s perspective and the situation affected employees face. In the process, they learn about technical aspects ranging from spear-phishing and social engineering to the step-by-step compromise of IT systems. The focus is not solely on attack techniques, but above all on their impact on business processes and communication, as well as on restoring the ability to operate.

The scenario thus creates a common foundation for investigating research questions, further developing security concepts, and practically testing procedures for real-world emergencies, so participants can better understand what to do when incidents occur.

Understanding Attacks Before the Emergency Starts

“The transfer of scientific findings into concrete business practice is a central part of the Fraunhofer mission,” says Sebastian Breu, an expert in cybersecurity, information security, and data protection at Fraunhofer FOKUS. “By focusing on everyday business operations and, at the same time, making transparent how attackers, technical vulnerabilities, and organizational processes interact, participants can immediately put themselves in the shoes of those facing an emergency. They understand how a cyberattack occurs and where they can increase their resilience.”

As a group manager at Fraunhofer FOKUS and an adjunct professor at the University of Applied Sciences HTW Berlin, he helps companies further develop their information security based on sound scientific principles. He does so in collaboration with colleagues from various fields of cybersecurity and IT security at Fraunhofer FOKUS. Their expertise ranges from application-oriented security concepts to secure data management, the testing and certification of IT systems, and quantum communication.

From Rule-Based Knowledge to Effective Action

The cybersecurity scenario is aimed at those responsible for IT and information security, business continuity, and crisis management, as well as managers in the private sector and public administration. In workshops, training sessions, and simulation exercises, they can practically test science-based measures for cyber resilience.

“In a workshop, I first asked the participants about the current rules and regulations. Everyone knew them. So my next question was: If everyone knows the rules, why doesn’t it work in an emergency anyway? It quickly became clear that communication and organization are crucial. That’s exactly why we need to not only think through incidents in theory, but also run through them and practice them together,” said Sebastian Breu.

The SIRIOS Lab opened in March 2026 with an extreme weather scenario for disaster management and has since been gradually expanded to include additional areas of application. It emerged from the Fraunhofer Center for the Safety of Sociotechnical Systems (SIRIOS), a consortium of several Fraunhofer institutes in safety research funded by the federal government and the State of Berlin from 2020 through the end of 2024.