What Happened in the Room?
The audience became a Singapore SME on a bad day. The company's accounts clerk had just typed her password into a fake Microsoft login. From there, everyone voted on their phones for what the business should do next, and the room made its way through the incident in three acts.
A phishing incident is a string of decisions made under pressure, by people who are not security specialists. So we asked the room to make them.
Why Start With a Fake Login?
Because it is one of the everyday ways a small business gets caught. A convincing login page, a moment of hurry, and an attacker has a working password to the company's email. What happens in the next hour depends on what the team does, and most teams have never practised it.
What Was the Masterclass About?
The session was billed as a CEO-level playbook for spotting digital risk before it becomes a crisis. It was written for SME owners who manage AI tools, cloud platforms, customer data and vendor integrations without an IT team or specialist staff. No technical pre-reading was required.
If you want your own team to practise decisions like these, our free Cyber Stories retell three real attacks on small businesses and let you make the calls yourself.
Related Reading
- Singapore Business Cyber Readiness Exercise, the national cyber crisis exercise for small businesses that StrongKeep facilitated.
- Think you're safe from cyber crooks?, Gaurav on The Straits Times podcast.
- What does the Health Information Act really ask of healthcare operators?, Gaurav's SHM 2026 keynote.
Frequently Asked Questions
What was StrongKeep's masterclass at SMEICC 2026?
The Business Leader's Digital Risk Playbook for the AI Era, given by StrongKeep CEO Gaurav Keerthi on 5 August 2026 at Suntec Singapore. It was run as a live game in which the whole audience played one Singapore SME dealing with a phishing incident.
What should a business do if an employee types their password into a fake login page?
Act quickly. Change the password straight away and sign the account out of every device. Turn on two-factor authentication if it is not already on, check the mailbox for forwarding rules an attacker may have added, and warn colleagues and customers to be wary of unusual messages from that account.
What is SMEICC?
A conference for small and medium enterprises in Singapore, organised by the Singapore Chinese Chamber of Commerce and Industry. The 2026 edition was held at Suntec Singapore on 5 and 6 August.
What Does StrongKeep Do?
StrongKeep is a self-serve cybersecurity platform for small and medium businesses. It bundles endpoint protection, phishing and malicious-link filtering, credential management, staff awareness training and phishing simulations, all run by the business itself from one dashboard. Compliance tooling is available on higher plans. StrongKeep holds the CSA Cyber Essentials Mark. Built for teams without an IT department. Plans are on the pricing page.
