A branching, choose-your-path tabletop built for an online brokerage. Nothing at Corbel is broken — its cloud provider is. The market is falling and customers can't get in. Six shared injects establish the outage, then the room's own decision — halt trading for everyone, or keep operating in a degraded state — sends the exercise down one of two independent, fully-scripted paths. Both of them end with customers who lost money.
Every detail below is fictional — specific enough to feel real in the room, and generic enough to map onto almost any firm whose customer-facing service runs on someone else's infrastructure.
A Chicago-based online brokerage with 2.4 million customer accounts, $180B in assets under custody, and ~1,900 employees. Its trading platform, mobile app, and order routing all run on a single public cloud provider, with a primary region and a warm-standby secondary region designed to take over within four hours.
Corbel's customers don't care whose servers are down. In a falling market, an hour without access is the difference between a loss and a complaint, and between a complaint and a lawsuit. Corbel's recovery plan assumes its cloud provider will have capacity when Corbel needs it. So does every other customer of that provider.
Six injects, delivered over the first four hours, that every player experiences regardless of what the room ultimately decides. This phase ends with the decision that splits the exercise in two.
Mobile app login errors spike. Nimbus Cloud's status page reports "elevated error rates" in Corbel's primary region. Futures are down 3% on overnight news, and the market opens in thirteen minutes.
The market opens down 4%. About 38% of customer orders fail, and the call center queue passes 9,000. Customers are posting screenshots of error messages on social media.
The failover to Corbel's secondary region needs about four hours. But the secondary region is running short of capacity, because many other Nimbus customers are failing over to it at the same time.
Customers with margin loans can't deposit funds or sell positions. Corbel's automated system will begin liquidating under-margined accounts at 2 p.m. About 6,000 accounts are at risk.
Nimbus can't give an estimated time to recovery. Corbel's contract caps compensation at a service credit worth 10% of the monthly fee. The clearing firm reminds Corbel of its end-of-day settlement deadlines.
The room has two options. Halt trading for all customers and freeze automated liquidations until the platform is restored — no one trades on partial access, but no one can exit a falling market either. Or keep operating in a degraded state: about 60% of orders go through, a phone desk handles others, and liquidations continue under normal rules. The room has to decide.
From here, the facilitator runs one of two fully independent scripts depending on what the room chose in Inject 6. Toggle between them below to see how each one unfolds — in a live session, players only ever see the one they earned.
Corbel announces a trading halt for all customers. Within minutes, "locked us in" is trending on social media. Competitors post ads inviting Corbel customers to transfer their accounts.
The market drops another 3%. Customers who wanted to sell can't. Plaintiffs' firms start advertising for Corbel customers who lost money during the halt.
Regulators ask under what authority Corbel halted trading, whether the halt was applied equally to all customers, and for a record of when the decision was made and by whom.
Nimbus restores most of the primary region overnight. About 400,000 orders were queued before the halt. Executing them at the open would fill them at prices customers never saw. Cancelling them all means customers have to start over.
The platform reopens to a surge three times normal volume. Latency spikes, and a second, shorter slowdown follows. The call center queue is back at 7,000.
Corbel receives 18,000 formal complaints, many asking for compensation for losses during the halt. The complaints team was built for about 400 a month.
Nimbus publishes its root cause: a faulty configuration change during routine maintenance. Corbel's contract gives it no meaningful remedy. The board asks why the brokerage depends on a single provider.
A member of Congress cites Corbel by name in a hearing on retail investor protections, describing customers who couldn't sell during a falling market.
The room must decide whether to reimburse losses for customers who can show they tried to sell during the halt — an estimated $41M — or handle claims case by case under the customer agreement, which disclaims liability for outages. The room has to decide.
Engineering estimates that running across two cloud providers, or two fully active regions, would cost about $60M a year. The board has to decide what level of resilience it's willing to pay for.
Trading continues in a degraded state. Whether a customer's order goes through depends on which servers it happens to reach. Phone desk wait times pass two hours.
At 2 p.m., automated liquidations begin. About 6,200 under-margined accounts are sold at or near the day's low — including many customers who tried to deposit funds but couldn't get through.
App retries cause about 3,400 orders to execute twice. Some customers now hold positions twice as large as they intended, in a falling market.
Regulators ask how Corbel ensured fair access for customers and best execution during the outage, and request order and liquidation records for the day.
Reconciliation with the clearing firm breaks. Positions on Corbel's books don't match the clearing firm's, and the gap affects Corbel's regulatory capital calculation.
A financial news site runs a story headlined around customers being "sold out at the bottom" by Corbel's automated liquidations, with interviews from affected customers.
Corbel receives 26,000 complaints, and arbitration filings begin. Many come from liquidated customers and those with duplicate orders.
Trading operations and engineering blame each other for the duplicate orders — in meetings and in writing. The chief risk officer asks why the retry logic was never tested against a degraded cloud region.
The room must decide whether to reverse the forced liquidations at Corbel's own cost — about $33M — or stand by the margin agreement, which allows liquidation without notice. The room has to decide.
Nimbus publishes its root cause: a faulty configuration change. The board asks why Corbel's entire customer-facing operation depends on one provider, and what it would cost to change that.
The two paths are built to converge on the same hard questions, arrived at from opposite directions.
The full Corbel scenario — every inject, both paths, and the debrief questions — is available as a print-ready PDF you can share with your own team or board. Enter your email and we'll take you straight to the download.
The Corbel exercise is a sample — built to show how a cloud outage simulation can branch on the decision that actually matters, and stay uncomfortable in both directions. A simulation built for your organization starts with your critical services, your vendors, and your customers.
Exercises often require access to crisis plans, escalation structures, and vulnerabilities. That material is handled in confidence, and NDAs are available on request.
Talk to us about a custom simulation →
The Crisis Studio