Facilitator guide/3 minute read

Pause, throw an event in, start again

A written exercise runs the same way every time. The moment you want to test something the script does not cover — a second wave, a reporter on the phone, a supplier going quiet — you throw it in yourself.

Hold the clock

Pause freezes the exercise for everyone.

Scripted events stop arriving and decision windows stop closing. Nothing is lost — the clock picks up from the same minute.

Throw the event in

Pick a ready-made event, or write your own.

Give it a sender, a channel and the text the room reads. Say why you are throwing it in — that line is saved beside the event.

Start the clock again

Resume restarts from the minute you paused.

Quick inject on the run panel does all three in one press — hold, land, restart — so you never switch screens mid-exercise.

Read it back afterwards

Every event lands in the debrief with its reason.

Exercise clock, time of day, who fired it and why. The remediation plan reads that list, so a run made harder is not judged as a plain one.

Deck

The ready-made events

9 cards

Each one carries its own pressure. Fire one on its own, or line several up and release them together.

Reporter has the details

press

A journalist quotes lines that could only have come from the internal bridge. They are running in ninety minutes and want a named comment.

Regulator calls early

regulator

They have seen the press chatter and want your preliminary assessment today, in writing, including whether personal data is involved.

Second intrusion wave

technical

Containment did not hold everywhere. Fresh logons using the attacker's tooling appear on two hosts that were declared clean.

Key person unavailable

internal

The one person who knows the failover runbook is on a flight for the next four hours. Nobody else has run it end to end.

Largest customer ultimatum

customer

Their security team wants a written statement within two hours or they start their exit clause. They represent eleven percent of revenue.

Attacker makes contact

attacker

The sender proves access with a file only your finance team had, and sets a deadline of midnight before publishing a sample.

Insurer conditions

legal

The panel insists their own forensics firm leads, and warns that any payment made without prior approval falls outside the policy.

Staff leak on social

social

A whiteboard with host names and the word RANSOM is visible in a post already shared four hundred times.

Clean backup found

internal

A tape copy from before the intrusion window restores in test. Recovery is possible without negotiating, if you accept a day of rework.

Worth doing when

The room settled on an answer early and nobody is re-checking it.
You want to see whether a decision holds when the facts move.
A real incident here had a twist the written scenario lacks.
Two teams run the same exercise and should be told different things.

Leave it alone when

Firing constantly — the room learns to wait for you rather than think.
Punishing a team that is already behind the clock.
Events with no reason written down; the debrief cannot account for them.