You sit on one executive team
In class, four teams run four companies, spanning Iceland, Norway and Italy, through 15 years, 2016 to 2030. Every player holds one seat, and no seat sees the whole picture. This demo puts you on NordPay.
A Reykjavík-based digital finance company founded in 2014. Started as a small payment processing platform and grew into a regulated fintech provider offering mobile banking, cross-border transfers, and lending. Serves both retail customers and SMEs across Iceland and expanding into Scandinavia. Its core product is a real-time cross-border payment rail built on correspondent-bank partnerships and open-banking APIs, which is exactly what makes payment fraud, credential stuffing, and third-party API dependency existential rather than theoretical risks. Its licence as a regulated e-money institution under EEA financial law means every incident carries PSD2 and AML reporting obligations on top of the technical cleanup. NordPay owns no branches and runs almost entirely on outsourced cloud infrastructure and vendor-supplied fraud-scoring models, so a single cloud-region outage or a compromised vendor can halt payments for its whole customer base at once.
Pick a seat
Each role reads the same year through different priorities, and is measured on different metrics. That disagreement is the seminar.
- Identify and prioritize current threat vectors
- Recommend proportionate security controls
- Build and test incident response capability