Malware & Management
A one-hour tabletop game for executives. Contain a fast-moving malware incident before it spreads, and before the business pays more than it can afford.
The whole game is a table, twelve points and a clock.
Malware & Management
A one-hour tabletop game for executives. Contain a fast-moving malware incident before it spreads, and before the business pays more than it can afford.
The whole game is a table, twelve points and a clock.
Four executives sit down: CEO, CFO, CIO, CISO. An Incident Master runs the scenario and voices the technical team. Your job is to resource it, authorise it and defend it, under a visible timer and a budget you cannot grow.
That is the whole design. In real incidents the technical fix is rarely what fails. What fails is who owns the trade-off, who was asked in time, and who said yes to the shortcut. So the game takes the keyboard away and puts the decision back where it belongs.
1
The Incident Master speaks for the engineers. They are fast, tired and literal. They do what you authorise, including the thing you will regret.
2
Security, Financial and Reputational, four steps each, visible on the table. Twelve points of Money, Time and Quality decide which risk you spend.
3
Roll only when there is real doubt. Your strengths add to the roll, backers add to the roll, and the band decides whether the complication lands.
1
Pick the scenario card, seat four roles, know which decisions it offers.
2
State the objective, read the Escalation Card, ask the CISO for the thirty-second summary.
3
Deliver it, take questions, call an Executive Decision when the card offers one.
4
When the last decision has resolved and you judge it contained, say so.
5
The verdict on the three risks, then the debrief: what failed was process, not the tool.
The one rule not to get wrong
You declare containment only after the last Executive Decision has resolved. The card's marks are necessary, not sufficient. Call it early and the table never pays for the decisions it was there to make.
Four role cards, one decision card per seat, the rules sheet, the table artifacts and the record the table fills in. The scenario card carries the cast, the injects, the decisions and the exhibits. All of it is A4, all of it is free.
Security leaders, executives, and the people who teach them. No tabletop experience is needed to sit at the table; the Incident Master needs one careful read.
Two versions: one table of four to eight, and a scaled room of twelve tables with a narrator.
Malware & Management, by Klaus Agnoletti. CC BY-NC 4.0.