Narrative Threat Emulation The 1-Day Sprint
Red cell attacks. Blue cell answers. Brief by five.Red cell moderators emulate live-style adversary narratives against your business for one workday. Your team detects, attributes, and counters, finishing the day with an executive brief and an after-action report.
Ship a tailored intelligence brief today while your staff learns repeatable methods for narrative threat detection and response.
Flat for 4 to 12 Blue Cell participants. Travel and expenses billed at cost.
One full day in person, at your site. Remote delivery on request.
Four participants, whatever the budget.
Executive brief, AAR, attendance list, certificates, delivery memo.
- What it is
- A one-day red cell versus blue cell exercise built on your PIRs and your sector
- Format
- In person at your site, 08:30 to 17:00. Remote delivery on request
- Team size
- 4 to 12 Blue Cell participants. Minimum four
- Price
- $18,500 per sprint, flat. Travel and expenses at cost. Prepaid
- Before the day
- 30-minute intake under NDA to lock PIRs, priority narratives and leadership questions
- You leave with
- One executive slide brief, one AAR with actions and owners, attendance list, certificates, delivery memo
- Pairs with
- CNIA seats in the Team Readiness package. Narrative Inoculation Sprint afterwards
- Eligibility
- Organizations in the United States, NATO, EU and allied nations
From intake to actionable intel. In hours.
Every component is a focused module that builds toward a finished, executive-ready output on the same day.
Intake Under NDA
What you get: 30-minute discovery to lock PIRs, priority narratives, and leadership questions.
Business Value: Production aligns to leadership decisions, not a generic sector sheet.
Red Cell Emulation
What you get: Narrative TTPs aligned to targeted adversary patterns and your sector.
Business Value: Teams practice against realistic tactics and channels.
Blue Cell Drills
What you get: Detection, attribution, and counter-narrative design with instructor coaching.
Business Value: Staff builds skill while producing real outputs.
Narrative Kill Chain Deck
What you get: A prebuilt deck and worksheet set that drives fast analysis and decisions.
Business Value: A clear path from signal to executive decision.
Executive Outputs
What you get: 1 executive slide brief + 1 AAR with actions and owners.
Business Value: Executives receive decisions and next steps the same day.
Proof & Compliance
What you get: Attendance list, certificates, and delivery memo.
Business Value: Audit-ready documentation for training and response.
08:30 to 17:00. Watch the room work.
Press play, or drag the clock. The red cell drops two inject waves. The blue cell logs, attributes and counters. Outputs land in the ledger as the day closes them.
Synthetic teaching scenario. Real injects are built from your intake and stay inside the exercise.
- 11:00Ranked PIRs and scoped evidence log
- 12:30Attributed narratives with source paths and maps
- 14:30Draft counters, disruption steps, decision options with risks
- 16:30Executive slide brief
- 17:00AAR v1 with action register and owners
- 17:00Attendance list, certificates, delivery memo
6 OF 6 OUTPUTS DELIVERED
One full day. Four blocks.
A full day in person at your site for 4 to 12 Blue Cell participants.
Kickoff to first signals
Modules: Kickoff, PIR Alignment, Red Cell Inject 1 → Blue Cell Detect & Scope.
OUTCOME: Ranked PIRs and confirmed signals with a scoped evidence log.Attribution
Module: Attribution & Narrative Kill Chain Mapping.
OUTCOME: Attributed narratives with source paths, amplifiers, and updated maps.Counter-design
Modules: Red Cell Inject 2 → Blue Cell Counter-Design & Triage.
OUTCOME: Draft counters, disruption steps, and decision options with risks.Brief and AAR
Modules: Executive Brief Build, Readout & AAR Assembly.
OUTCOME: A final executive brief and AAR v1 with an action register and owners.Signal to decision. Five stages.
A proprietary framework that drives fast analysis and clear decisions during the sprint.
| Stage | Definition | Analyst Task | Sprint Output |
|---|---|---|---|
| Origin | Where the narrative starts | Record source, language, and timestamp | Source log with links and screenshots |
| Packaging | How operators frame the message | Tag frames, visuals, slogans, and claims | Frame tags and artifact gallery |
| Amplification | How the message spreads | Map channels, bots, and influencers | Channel graph and reach notes |
| Engagement | How targets interact | Track comments, shares, sentiment cues | Engagement table with cues and examples |
| Effects | What harm or impact occurs | Link narrative to business outcomes | Effect map tied to PIRs |
Narratives, not only IOCs.
Focus on adversary TTPs and decision support, not just tooling and IOCs.
| Indicator-Only Training | NTE 1-Day Sprint |
|---|---|
| ✕Focus on IOCs and tooling | ✓Focus on narrative TTPs and decision support |
| ✕Slides without outputs | ✓Executive brief and AAR before day-end |
| ✕Generic sector examples | ✓PIR-aligned injects tied to your leadership questions |
| ✕No link to comms or legal | ✓Counter plans that include comms, legal, and HR levers |
One flat fee. Four to twelve seats.
The sprint price holds from four participants to twelve. Add CNIA seats and the day becomes the Team Readiness package: certified analysts first, then the team exercise.
$18,500 flat, plus travel and expenses
$2,313 per participant for the day
$0 at $5,299 each, exam included
Train. Exercise. Inoculate.
Each analyst earns the Certified Narrative Intelligence Analyst credential online. $5,299 per seat, graded live practical exam included.
The team runs the 1-Day Sprint together, in person, against narratives built for your business.
The Narrative Inoculation Sprint follows as a separate ten-day engagement, priced on its own.
Training is prepaid. The sprint stands alone; CNIA seats are optional and sold at full price.
Before and after the sprint.
Jeff Bardin
FOUNDER AND CHIEF INTELLIGENCE OFFICER, TREADSTONE 71
Fourteen years of US military service across the Air Force and Army, enlisted and officer: cryptologic linguist, then armored scout platoon leader. Builder of the cyber intelligence, cyber counterintelligence and cybercrime programs at Utica University. Author of The Mind Domain and Tradecraft at Machine Speed.
Woman-owned, veteran-led cyber and strategic intelligence training and consulting since 2002. Our People and Narrative Intelligence course is listed in the CISA NICCS training catalog.
Ready to book? Contact Treadstone 71 with your team size, location and preferred dates.
Questions answered.
What is the Narrative Threat Emulation 1-Day Sprint?
A one-day team exercise. Treadstone 71 red cell moderators emulate adversary narratives against your business while your blue cell detects, attributes and counters them. The day ends with an executive brief and an after-action report.
Where is the sprint delivered?
In person at your site, 08:30 to 17:00. Remote delivery is available on request.
How many people take part?
4 to 12 Blue Cell participants. Four is the minimum, whatever the budget.
How much does it cost?
$18,500 per sprint, flat for 4 to 12 participants. Travel and expenses are billed at cost. Training is prepaid.
What do we leave with?
One executive slide brief, one AAR with actions and owners, an attendance list, certificates and a delivery memo.
What happens before the day?
A 30-minute intake under NDA to lock PIRs, priority narratives and leadership questions. Treadstone 71 builds the red cell injects from that intake.
Do participants need the CNIA credential first?
No. The sprint stands alone. Teams that add CNIA seats at $5,299 each buy the Team Readiness package: certified analysts first, then the team exercise.
What comes after the sprint?
The Narrative Inoculation Sprint, a separate ten-day engagement priced on its own.
Your executive brief, delivered today.
Pick a date, run the 30-minute intake, and receive timeboxed calendar holds for the full team. Expect a draft brief by mid-afternoon and final deliverables before close of business.
