Answer
Operation Silk Harvest puts four executives in a BioGenix incident where an attacker has been stealing research data for weeks. They make three Executive Decisions and a few leadership calls, and the IM declares containment when two marks are set.1
- The table decides what stops, whose time is spent and what exposure is carried, and what is said outside. The technical work stays off-screen.1
- Each decision runs against a visible timer (3 minutes in this script, a default the IM may change), then a vote, a d20 roll only if there is doubt, and printed costs on the three risks.1
- The plan is 56 minutes on paper plus 4 minutes of float, sized to the workshop slot. No part of it has been run with players.1
- Whatever the verdict, the debrief reveals three hidden exhibits that explain how BioGenix got here.1
Applies toScript v0.49, table kit v05 and rulings of 2026-10-23arithmetic only, never played or timed
Why is management in the room?
Diagram structure
- National CSIRT warns the CISO
csirt - Team confirms an attacker is inside
confirm - Executives convened, first brief
convene - Inject 3 and Decision 1
i3 - Inject 4 and Decision 2
i4 - Inject 5 and Decision 3
i5 - Inject 6, containment or not yet
i6
The CSIRT call came about two hours before the table, as the card says. The team confirmed the attacker at 12:55 and the executives sit five minutes later, so the executives are called at the finding, not at the warning.1 The lesson behind the opening is that nobody inside BioGenix saw this for three to four weeks.
How does the hour flow?
Diagram structure
- Brief and opening risk
open - First call
call - Decision 1: what stops today
ed1 - Decision 2: whose time, what exposure
ed2 - Decision 3: what do we say
ed3 - Containment?
end - Verdict and debrief
verdict call→ed1· owner nameded1→ed2ed2→ed3ed3→endend→verdict· two marks setopen→call
- Brief and opening risk
One full brief and the Escalation Card. Each seat states the one risk it owns, as: if this happens, then that.
- First call
The CEO names the incident lead, the owner of the old system and the CSIRT contact. Anyone may object, which forces a vote. If nobody is named, Security gets one step worse.
- Decision 1: what stops today
Research goes dark now, or stays exposed for a bounded window, or waits with no limit.
- Decision 2: whose time, what exposure
Pull the integration team, buy overtime, or use the internal team only. Restart before certification and the consultant offer sit inside this box.
- Decision 3: what do we say
One stance toward the CSIRT and stakeholders: open, measured or hold.
- Containment?
The IM declares it after Decision 3, when Ways in shut and Leak stopped are both set.
- Verdict and debrief
Containment reached or not yet reached, a cost sentence, then the exhibits are revealed.
Where could the hour go?
The blocks sum to 56 minutes (6+3+7+2+6+2+5+8+2+2+13). The float also pays for the Financial-Critical board call (1 minute) if it fires.1 This is a planning aid for the workshop slot, not a game rule: an IM may run it longer or shorter. If a timed run exceeds 60, cut in this order: the consultant offer, Exhibit B (reveal it in the debrief), the false lead, then merge Decision 1 and Decision 2. A fourth decision is never added.
What are the options and what do they cost?
| Option | Cost on the board | Roll target | Complication | Kind |
|---|---|---|---|---|
| Decision 1 a: Dark now | Financial +1, Reputational +1 unless Decision 3 is Open | None if an owner was named, else 10+ | Financial +1 | Choice |
| Decision 1 b: One-hour window | Security +1 | 10+ | Security +1 | Choice |
| Decision 1 c: Wait, no limit | Security +2 | 15+ | Security +1, Financial +1 | Wait |
| Decision 2 a: Pull the integration team | Financial +2 | None | None | Choice |
| Decision 2 b: Emergency budget and overtime | Financial +1 | 10+ | Reputational +1 | Choice |
| Decision 2 c: Internal team only | Reputational +1 | 10+ | Reputational +1 | Wait |
| Decision 3 a: Open | Financial +1 | 10+ | Reputational +1 | Choice |
| Decision 3 b: Measured | Reputational +1 | None if the CSIRT contact is named and General Counsel confirmed, else 10+ | Security +1 | Choice |
| Decision 3 c: Hold | Reputational +2 | 15+ | Reputational +1 | Wait |
Targets are printed on the option cards, so the IM does not judge difficulty on the day. Where the narrative text and section 7b differ, 7b is right.1
What do the extremes look like?
| Path | Security | Financial | Reputational |
|---|---|---|---|
| Cautious: Decision 1 a, Decision 2 a, Decision 3 b | Steady | Critical | Serious |
| Cost-cutting: Decision 1 b, Decision 2 c, Decision 3 c | Strained | Steady | Critical |
These are the script's own sums with no shields, starves or failed rolls.1 The cautious path reaches Financial Critical, so the emergency board call fires. The script's third path (greedy, every complication) lists Financial at Serious, but its option costs add up to Strained.
What is hidden, and how is it found?
Diagram structure
- The root cause
root - Exhibit A: supplier exception was never reviewed
a - Opens on: How did they get in?
a-ask - Exhibit B: old system stayed on, owner never named
b - Opens on: Why is it still on? Who owns it?
b-ask - Exhibit C: merger-era postponements, nobody owned the whole
c - Opens only in the debrief
c-ask root→aa→a-askroot→bb→b-askroot→cc→c-ask
Exhibits are management documents, never technical artifacts. If nobody asks, the IM does not give: the debrief shows them and asks what they say.1 The false lead ("it is probably just the quarterly refresh") is a cut candidate that tests why a comforting answer felt convincing.
Who speaks besides the four seats?
| Voice | Played by | Pushes on |
|---|---|---|
| CTO | IM | Shut the door and keep the evidence; cannot certify clean for a day alone |
| VP Research and Development | IM | Every dark day loses research ground |
| General Counsel | IM | No one says "not notifiable" yet; what may be shared |
| Head of Communications | IM | A defensible position rather than certainty |
None of them vote, decide, roll or use a lift.1