Free lab · no signup · about 8 minutes
Corporate Espionage Response Lab
Six fictional cases where your trade secrets may be walking out. Choose the proportionate response and spot the real warning signs, without trampling due process.
Loading the case files…
The rules the debriefs follow
- Preserve before you act. Logs and records you keep now decide what you can do later.
- HR and legal early. CISA’s guide runs insider cases through a team that includes HR and legal, not security alone.
- Behaviour, not identity. Warning signs are things people do. Nationality, ethnicity, religion and visa status are never evidence.
- Proportionate monitoring. Broad covert monitoring, searches and access to personal accounts need a legal basis and legal sign-off.
- Reasonable measures. Under 18 U.S.C. 1839(3), information is only a trade secret if you took reasonable measures to keep it secret, so ignoring a breach can cost you the legal protection itself.
Cases, names and companies are fictional. This is training, not legal advice.
Questions
What is the Corporate Espionage Response Lab?
A free browser lab where you play the CISO in 6 fictional trade-secret cases, drawn from a pool of 8: bulk downloads before a resignation, a recruiter approach, a supplier asking for design files, a visitor photographing a lab, source code synced to personal cloud storage, a joint-venture partner over-requesting data, an anonymous tip and a contractor’s last week. For each case you pick the most proportionate response and mark the genuine warning signs.
What is a proportionate response to suspected trade secret theft?
Usually: preserve the evidence first, involve HR and legal early, restrict access at a moment legal agrees, and refer to law enforcement once you have preserved evidence and a clear description of what was taken. Doing nothing and over-reacting are both mistakes. Public accusations, seizing property and covert access to personal accounts can be unlawful.
What are the warning signs of an insider stealing trade secrets?
The FBI’s insider threat brochure lists behaviours such as working odd hours without authorisation, taking proprietary information home in hard copy or on removable media or email, unnecessarily copying material, disregarding policies on personal software and hardware, and suspicious contacts with competitors. CERT adds that a sharp change from a person’s normal pattern, especially around a departure, is a key indicator. None of these is proof on its own.
Why does the lab penalise some details?
Nationality, ethnicity, religion, visa status and similar characteristics are not evidence of espionage. Using them is discrimination, is unlawful in most places and sends investigators after the wrong people. An employee who reports an approach is a strength, not a suspect. The lab marks these as details you must never use.
Is this legal advice?
No. The cases and companies are fictional and the debriefs are general training. Employment, privacy and criminal law differ by country, so involve your own legal counsel before acting on a real case.
Sources
- FBI, The Insider Threat: An Introduction to Detecting and Deterring an Insider Spy. Behaviour list as quoted by Poynter, 14 May 2012: https://www.poynter.org/reporting-editing/2012/journalist-or-corporate-mole-fbi-tips-make-difference-difficult-to-detect
- Carnegie Mellon SEI CERT, Common Sense Guide to Mitigating Insider Threats, Seventh Edition (2022). Best practices including knowing critical assets, least privilege, baselining normal behaviour, closing exfiltration routes and thorough termination procedures.
- CISA, Insider Threat Mitigation Guide. A multidisciplinary insider programme (security, HR, legal, IT, leadership): define, detect and identify, assess, manage.
- 18 U.S.C. 1831: Economic espionage. Theft of a trade secret to benefit a foreign government, instrumentality or agent.
- 18 U.S.C. 1832: Theft of trade secrets. Theft of a trade secret for the economic benefit of anyone other than the owner.
- 18 U.S.C. 1836: Civil proceedings (Defend Trade Secrets Act 2016). The owner of a misappropriated trade secret may bring a federal civil action.
- 18 U.S.C. 1839: Definitions. Information is a trade secret only if the owner took reasonable measures to keep it secret.
Keep going
- Corporate Espionage & Insider Risk Scorecard: score the controls that protect your crown-jewel IP.
- Insider Data Theft Lab: play one departing-engineer case in depth.
- Insider Incident Response Checklist: the step-by-step version.
- What is corporate espionage? Signs, examples and defences.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.