Cydonia Risk Simulator
Compare your security options before you invest.
Simulate a ransomware or payment-fraud attack. See how changes to backups, access controls, and response plans affect the estimated damage to a fictional business with settings you choose.
About 10 minutes. No account or installation needed.
Results are illustrative estimates, not predictions or an assessment of your network.
How it works
Run a scenario. Compare the changes.
- 01
Describe your setup
Choose your company size, where your systems run, and how you handle security today. Select ransomware or payment fraud.
- 02
Follow the attack
Watch ten simulated days unfold. See how the attacker gets in, which systems are affected, when alerts appear, and whether backups survive.
- 03
Compare your options
Test your starting setup against 300 simulated attacks. Choose up to three security changes and rerun the same attacks to compare the results.
Use the results
Bring a clear comparison to the meeting.
Print a decision memo with the before-and-after estimates, your proposed changes, and space to assign an owner and a date to each action.
Use it to discuss security spending with your leadership team or IT provider. In exercise mode, your response team can pause at each event and work through the decisions together.
About the model
What to know about the results
How should I use the estimates?
Use them to compare choices and discuss priorities. The systems, incidents, and costs are fictional. Cydonia does not inspect your network or establish compliance with a security standard.
Where do the assumptions come from?
Attack timing and detection assumptions draw on Sophos’s 2026 incident reports, with checks against Mandiant’s M-Trends 2026. Other model values are design estimates. The simulator lists its sources and assumptions so you can review them.
The same inputs and attack set produce the same results, so you can repeat a comparison.
What happens to the information I enter?
The simulation runs in your browser. An organization name is optional, used only as a display label, and is not transmitted.
A guided session with Kosma
Work through the decisions with Hadi.
Bring the person who runs your IT. Together, we’ll work through an attack, review the results, and build a priced plan for the changes you want to make.
You leave with a decision memo and next steps. You decide who carries out the work.