You are the lead analyst. Each run drops you into a scenario at a fictional organisation with a randomised security posture. Every decision is rated from Poor to Best. Good decisions push the attacker back; weak ones give them momentum, raise business impact and cost stakeholder trust. Even the best move can fail: every good action rolls against odds shaped by difficulty and by the organisation's controls. Poor moves occasionally get a lucky break.

Injects interrupt the plan: journalists, regulators, insurers, board members, and the things that really happen at 3am, like rats in the fibre duct. If attacker momentum reaches 6, the scenario escalates. If business impact reaches 100, the incident overwhelms the organisation and the run skips to lessons learned.

Incident response phases

Runs follow the SANS PICERL lifecycle: Preparation, Identification, Containment, Eradication, Recovery and Lessons learned. NIST SP 800-61 covers the same ground as Preparation, Detection and Analysis, Containment Eradication and Recovery, and Post-incident activity; its 2025 revision maps them onto the CSF 2.0 functions.

Cyber kill chain

Lockheed Martin's seven stages: Reconnaissance, Weaponisation, Delivery, Exploitation, Installation, Command and control, Actions on objectives. The strip under the meters lights up as the attacker's progress is observed. The debrief rebuilds the full chain, including the steps that happened before anyone noticed. Mapping ATT&CK techniques onto kill chain stages is approximate, since post-compromise activity loops.

MITRE ATT&CK and ATLAS

Each situation is tagged with the ATT&CK techniques behind it, and analyst checks ask you to name the technique or stage before the outcome is revealed. The check never uses a technique whose name is already on screen. The AI agent scenario uses MITRE ATLAS, the equivalent knowledge base for attacks on AI systems, and the plant scenario uses ATT&CK for ICS.

Scoring

Decision quality 40%, business impact 25%, stakeholder trust 15%, speed 10%, analyst checks 10%. With analyst checks off, the other four are scaled up to fill their share. Failed runs are capped at 70%. Grades run from A (CISO material) to F (front page news).

Running a workshop

• Turn on workshop mode and put it on the projector. Each decision shows a discussion prompt.
• Give teams the same seed and scenario so they face the same organisation and the same dice, then compare debriefs.
• Options are written so the right answer isn't the longest or the most detailed one. Make the room argue from reasoning, not wording.
• Discuss before choosing. The rating and the reasoning appear after the choice, so the room can argue about it.
• Use the custom tab to drop in the client's name, people and real posture so the scenario lands closer to home. Save the profile to reuse it.
• Finish with the saved Markdown debrief: it has the timeline, the missed moves, the attack path and a lessons list you can hand to the client.

Notes

Organisations, people and vendors are fictional. IP addresses come from documentation ranges. Regulatory timelines (GDPR 72 hours, NIS2 24 and 72 hours) are simplified for training and are not legal advice. Everything runs client side with no network calls.