Pasar al contenido principal



Bridge your organisation’s skills gap with expert-led training tailored to the role, knowledge and requirements of the individuals involved. 

Thomas Murray’s cyber risk management and resilience training focuses on enhancing the knowledge and awareness of teams, regardless of the starting point.

Training types


Executive briefings


Table-top exercises


First Responder Training


Cyber awareness workshops

Table-top exercises

Table-top exercises can be directed at boards, operational management and/or technical response teams within your organisation. The objective is to run through a cyber security incident scenario, stress-testing current response procedures, decision making and thought processes to develop incident response ‘muscle memory’ in a safe and supportive environment.  ​

Cyber security briefings

Cyber security briefings can be tailored for any sector and geography, educating executive teams on current threats and relevant recent incidents, drawing out lessons to be learnt and recommendations for good practice in incident response and cyber security controls.  

Thomas Murray cyber alerts

Thomas Murray cyber alerts

Subscribe to stay up to date with developing threats in the cyber landscape

Proactive security

Attack simulation: Red Teaming and Purple Teaming

Our attack simulations consist of planned exercises which attempt to cover relevant threat actor’s methods.

Red Team 

A ‘Red Team’ exercise demonstrates the art of the possible and tests the ability of your preventive and detective controls. We challenge the current security posture of the organisation in a controlled way, using our experience and threat intelligence of how organisations in each industry/sector are being compromised. ​

Our objective will be to gain persistent access to networks and ultimately access business critical functions and sensitive data. ​

The exercise will test the ability of client teams and their controls to react under pressure and is a learning experience that highlights and identifies areas for improvement.  ​

Purple Team

A ‘Purple Team’ exercise works in collaboration with your security team to ensure that controls are acting as expected and to highlight any potential gaps in defences. ​

Thomas Murray’s approach takes our knowledge of real-world attacks and the threats faced by your sector to produce a realistic, but risk managed, cyber-attack against your defences.

Planning often uses the standard Mitre Attack framework in collaboration with threat intelligence to articulate the objectives of the exercise in replicating real-world malicious activities.​

Attack simulation exercises are carefully presented as a learning experience, enabling organisations to have confidence in their defences and identifying areas for improvement. ​

Our objective will be to simulate the various attack vectors seen in the wild and work with your team to ensure that effective preventive and detective measures are in place.

Thomas Murray simulates the most common attack vectors during the following stages

Simulate social engineering via phishing

Simulate social engineering via phishing

  • Identify high-value targets using internet reconnaissance.
  • Craft realistic emails that appear to come from a legitimate source and containing legitimate content.
  • Weaponise emails to install our custom malware on the target’s computer or steal authorisation credentials our team will use to access the network.
Simulate insider threat

Simulate insider threat

  • Mimic an internal user who has authorised access to the internal network.
  • Assess the level of access that can be achieved using authorised equipment, such as laptops.
  • Determine whether abuses of policies and procedures can be detected by your organisation.
Simulate insider threat

Attack path validation

Using standard frameworks, such as the Mitre Att&ck framework we work with client teams to identify and test specific attack paths that might be relevant to them. 

This may be because of a previous breach and a need to re-test new or tightened controls, or because of an industry or sector-wide cyber security campaign being waged by adversaries.

Cyber risk consulting

Our cyber risk advisory services help organisations to address fundamental challenges and opportunities around cyber risk, resilience and regulation. 

The increasing frequency, sophistication and severity of cyber incidents is driving awareness across the business landscape. Thomas Murray’s Cyber Advisory Practice takes a threat-intelligence-led approach to solving our clients’ most complex challenges: 













vCISO services

Virtual CISOs (vCISOs) act as a friendly challenger and partner to organisations’ executive management and board as they seek to mature their cyber security posture.

The vCISO acts as your single point of contact, supported by our team of experts with experience across all the cyber domains. They provide regular advice and support to any cyber security initiatives within the business, while keeping management up-to-date on key cyber threats and issues. 

Cyber Risk Management

Cyber risk management

Management Reporting

Management reporting

Ad Hoc SME Advice and Support

As-needed subject matter expertise (SME) advice and support

Advice and Support Cyber Programme and Transformation

Cyber programmes and transformation

Maturity assessment

Our skilled team members use subject matter expertise (SMEs) as the basis for a comprehensive approach to conducting cyber security reviews against industry frameworks (such as ISO 27001, NIST, CIS etc).

We combine interviews with output from Thomas Murray’s Orbit Risk platform to provide strategic and operational views of cyber security across the business. We seek to answer key questions: 

Question mark

Are cyber security controls implemented across the whole business?

Question mark

Are the adopted practices aligned to good practices?

Question mark

Are current security-related initiatives sufficient? What more does the organisation need to invest in?

Question mark

How is the business organised to ensure appropriate resources, responsibilities and accountabilities are in place?

Question mark

Is the organisation managing cyber risk appropriately?

Question mark

Does the organisation have good capabilities to detect and respond to cyber attacks?

Question mark

What is involved in undertaking a cyber security transformation journey?

Protegemos a los clientes y sus comunidades

Communities Logo 02

Northern Trust

“Thomas Murray proporciona a Northern Trust una variedad de productos, servicios y tecnología de solicitud de propuesta para la recolección de propuestas, lo que brinda una solución eficiente y rentable que libera a nuestros gerentes bancarios para que se concentren en actividades de mayor valor.”

Petroleum Development Oman Pension Fund

Petroleum Development Oman Pension Fund

“Thomas Murray ha sido un aliado valioso en el proceso de selección de nuestro custodio para Petroleum Development Oman Pension Fund.”



“Thomas Murray ahora juega un papel clave para ayudarnos a detectar y remediar problemas en nuestra postura de seguridad, de la misma manera que a cuantificar, para nuestros directores y clientes, el rendimiento de seguridad de ATHEX.”