Incident response, as a game you can lose.
You play the responder in a fictional breach — ransomware, business email compromise, cloud takeover. Every decision moves the incident clock, every call is scored against IR best practice, and the debrief explains what the better call was and why.
Fiction only · no systems connected · solo, team and live audience play
Backup console reports mass file renames across thirty servers. No alert has fired. The on-call engineer asks what you want to do, and the clock is already running.
Declare the incident, open the case and start the clock
Best practice · Preparation
Wait for the SIEM to corroborate before escalating
Acceptable · Detection & Analysis
Isolate the backup network first and tell nobody yet
Risky · Containment
Scenario library
Incidents drawn from the failures that actually cost organisations the most.
Meridian Regional Health — Ransomware
An encryptor is inside the EHR estate at 02:00 on a Friday, the retention playbook is two years old, and every containment move costs someone clinical access.
Northwind Capital — Payroll Diversion
A finance lead has been spoofed, the payroll file is already out, and the bank change-over cut-off is ninety minutes away.
Halyard Cloud — Stolen API Keys
Customer data is leaving through an over-permissioned service account, the key is still valid, and the repository that leaked it is still public.
Kestrel Managed Services — Contractor Backdoor
A tooling vendor has been trojanised and every client environment inherits it. Prioritise 140 environments, disclose, and keep the contracts intact.
The path an incident takes
The attacker moves on one side, you answer on the other. Each call is scored the moment you make it, and the chain keeps going either way.
- Email gateway
Invoice-themed phishing email reaches the finance team, one attachment opened.
01:48PreparationBest practice+10Report it and open a case with a named owner
- EDR alert
Encoded PowerShell runs on three hosts. No data movement yet.
02:14Detection & AnalysisRisky+3Wait for the SIEM to corroborate first
- Backup server
Admin credentials are used to delete the shadow copies.
03:02ContainmentBest practice+10Cut the VPN and isolate the backup subnet
- Ransom note
Forty servers are encrypted and the note gives you seventy-two hours.
05:40Eradication & RecoveryAcceptable+6Rebuild from clean backups, rotate domain admin
- Leak site
Two gigabytes of client files appear on a leak site overnight.
09:15Post-IncidentBest practice+10Notify affected clients and brief the board
Two ways to play
The same scenario works as individual training or as the exercise you run for a client.
Solo run
One responder works the incident alone at their own pace. Decisions are scored individually, so repeat runs show whether the reflex is improving.
- Own incident clock
- Instant consequence after each choice
- Personal debrief and run history
Facilitated session
One screen, one room. You drive the injects, the team argues the call, and the group commits to a decision that is scored exactly like a solo run.
- Team named on the record
- Facilitator notes captured as you go
- Group debrief for the after-action review
Live rooms · for webinars and town halls
Run one incident for a room of two hundred.
Open a live room, share the code, and let the audience take the decisions together while you narrate the consequences. Every vote is recorded, so the debrief works for the people who were in the room.
- The audience votes from their phones — no account needed to take part
- The room majority becomes the call, and the scenario follows it
- Votes are tallied live so the facilitator can talk through the split
- The run still ends in a scored debrief, attributed to the room
4821
How a run works
Take the brief
The organisation, the systems at risk and the objectives you will be judged against.
Decide at the clock
Each scene lands with a timestamp, incoming intel and three defensible ways forward.
Live with it
Your call lands a verdict and changes what the incident becomes. Some doors close for good.
Debrief
Score, phase-by-phase breakdown and the rationale behind the call you should have made.
For your team, your clients, your pipeline
Put the room in front of a bad day.
Create an account to take a scenario yourself, or sign in to facilitate one for a client team and carry the debrief into their after-action review.