Operation Silk Harvest: scenario card

An attacker has been inside a life-sciences company for weeks, and the executives are told at one o'clock. This card gives you the story, the cast, the injects and the three Executive Decisions for a session of about an hour. It follows the rulings in the guide. Where a detail is open, it says so, and you rule.

From source card carried from the vanilla Winnti card in plain business wordsNew for this card or Assumed written for this card, not ruledRuled decided by the game's author

Sessionabout an hourFour executives. The technical team works off-screen. Ruled

SeatsCEO, CFO, CIO, CISOFour NPCs you play: General Counsel, Head of Communications, COO, Chief Risk Officer. Ruled The CTO and VP R&D are off-screen characters you voice.

Executive DecisionsUp to 3Menus fixed by this card. Ruled All three are played in a session of about an hour. Assumed

Risks that leadFinancial, ReputationalSecurity always counts. The IM reads the priority from this card. Ruled

Regulatory markerPossible duty, openA marker, not a fourth risk. No deadline is asserted; General Counsel is assessing.

StatusBuilt from the Winnti card.The mechanics come from core/rulings.md. Assumed

Read aloud at the start New for this cardA national CSIRT called your CISO a couple of hours ago with a warning about a campaign against life-sciences companies. BioGenix has seen Chinese threat actors in its network before. That is all the record says. Your technical team has been checking since. At five to one they found that you are part of it. Here is your first brief. You are the executive team. The technical team will tell you what it finds. You decide what it is allowed to do, what it may spend and what you are prepared to say.

From source card The hook: it is Thursday, 13:00. The CISO's first line to the teams in the source card is "we do not yet know if we are compromised". Here your technical team has found out that you are. What you cannot afford is to be the last to know.

The company and what is at stake

From source card BioGenix is a life-sciences company built on a precision-fermentation platform. Its crown jewel is GenixLibrary, three years of proprietary genomic sequence research. It recently merged with another firm and is still integrating infrastructure. Active fermentation projects depend on the library.

The lesson behind the openingNobody inside BioGenix saw this for three to four weeks. It was the warning from outside that turned it up.

Ruled Table rule for this card: the table never sees technical artifacts such as logs, scans, certificates or tool names. Everything it sees is business language and management exhibits. Plain words such as "system" or "research cloud" are fine; never state jargon or say "this is a supply chain compromise". New for this card

The Escalation Card

Ruled The Escalation Card has a severity cell and a page rule. Put it on the table with the first brief, so the table can see why it is called now. The routing rule is an illustration of how a firm might route, not a claim about every firm. New for this card

Lower urgency

Higher urgency

Impact, high at top

Assess

ConveneThis incident

Watch

Assess

This incident: high impact and high urgency. A crown-jewel system, with credible spread or data loss.

Page rule. The technical lead and the CISO assess. When the cell reaches HIGH, or a decision exceeds their authority (spend, disrupting research, speaking outside), the executive incident lead convenes the executives and counsel. Board notification is a separate step and is not played.
What crossed the line, and when. The call from the CSIRT was about two hours earlier, at about 11:00. At 12:55 the technical team confirmed that an attacker is inside, with data probably gone. The way in stays ask-gated. They escalated within minutes. The executives sit at 13:00. New for this card This follows the source card, which says "a couple of hours": the executives are called at the finding, not at the warning.
Open question for the table. Is any legal or notification duty possible? General Counsel raises it as an assessment in progress. No deadline is asserted.
"Why were we called now?" The table may ask once, for 30 seconds. Answer: the finding that justified it came five minutes ago, about two hours after the call, and the attacker has been in for weeks. Longer discussion is banked to the debrief.

The briefThe rulings fix one full brief at the start, then short briefs at each inject. Ruled A short brief has three lines: what changed, what is new and unknown, the new deadline. The CISO player gives the table a 30-second decision summary, and the CTO, voiced by you, supplies the facts.

A full brief has seven fields1. What happened and the business impact, in one sentence. 2. What we know and what we do not, each tagged Confirmed, Probable or Unknown, with its basis, an "as of" time and, for each Unknown, what would change it. 3. What the technical team is doing now. 4. The decision: two or three options, each trade-off, the team's recommendation, whether it can be reversed, and what happens if the table waits. 5. Who the table proposes to own it, and by when; the table assigns the owner. 6. Any open legal or notification question. 7. Next update time.

Assumed Time budget: the first brief and escalation card 2 minutes, each short brief 20 seconds, the challenge 30 seconds, five minutes in total. If a run goes long, shorten the short briefs. A brief carries what a decision needs and never explains why it happened: causes stay Unknown until a player asks. Before a vote the CISO states one sentence: "we are deciding X because we know Y and do not know Z". If it is missing, wait for it; do not refuse the vote. Assumed Opening round, 60 seconds, after the read-aloud and the brief. In seat order (CEO, CFO, CIO, CISO), one sentence each, written on the seat card, never scored, no debate. Say: "Speaking as your seat, with your own judgment: state the one risk this warning creates for BioGenix that your seat owns. Say it as 'if this happens, then that', in your own words, not as a category." If an answer is a category word, is generic or is about last time, say once: "Say it as if-then, for BioGenix, today." The debrief lays each line beside the seat's votes: did the decisions reduce that risk, accept it or trade it for another?

The cast

CEOSeat, votesOwns the call on stakeholder accountability and what the firm is prepared to say.

CFOSeat, votesCarries the cost of a halted fermentation week and of any outside help.

CIOSeat, votesContainment happens in IT. The CTO reports here.

CISOSeat, votesTook the CSIRT call. Gives the 30-second summary before each vote.

CTOVoiced by you From source cardWants to cut the door shut and keep the evidence. The voice of the off-screen team. The source card gives evidence preservation to the CISO; here the CTO carries it too. New for this card

VP Research and DevelopmentVoiced by you From source card"Three years of my team's work is on that network." Protects research continuity.

General CounselNPC New for this cardWill not let anyone say "not notifiable" yet. Evidence, privilege, who may be told what.

Head of CommunicationsNPC New for this cardWants a position, not certainty. Stakeholders, the press, a defensible account.

Ruled The other NPCs are General Counsel, Head of Communications, COO and Chief Risk Officer. They give facts, advice, questions and pressure, and never vote, decide or roll. A fifth to eighth player converts an NPC into a seat with one vote, in this order: General Counsel, Head of Communications, COO, Chief Risk Officer. A converted seat has no specialty strengths. A decision passes by strict majority: 3 of 4, 3 of 5, 4 of 6, 4 of 7, 5 of 8. A tie fails. New for this card The CTO and the VP R&D come from the source card; you voice them as the technical team and research leadership. They are never seats. This card uses General Counsel and Head of Communications most.

The hour

9 minOpening and first callEscalation Card, the one full brief, read-aloud, opening risk round, rules in 90 seconds, the first call

7 minExecutive Decision 1Inject 3, the Rules Card for the triangle and roll, timer, vote, narrate

8 minInject 4, Decision 2Short brief, the CTO's estimate, restart vote, the consultant offer

7 minInject 5, Decision 3Short brief, the CSIRT's request, timer, vote, narrate

10 minQuestions and bufferThree question windows and slack for the Financial-Critical board call

15 minVerdict, debriefThe two-part verdict, then the debrief

Assumed This is a plan for a workshop slot of about an hour, 56 minutes on paper plus about 4 minutes of float. It is arithmetic, never played. The game itself has no hard stop: your IM decides whether and when to call time. Inject times such as 13:00 are story time, not table minutes. The three-act shape: Act 1 sets up why now and who has skin in the game; Act 2 escalates, and things worsen the longer the table waits; Act 3 is the climax and the verdict, then the debrief. If a run goes long, cut in this order: the consultant offer, Exhibit B (show it in the debrief), the false lead, then merge Decisions 1 and 2. A fourth Executive Decision is never added.

The injects

Each inject arrives as a person who wants something, carries a price and a deadline, and ends in a question to a seat. Inject 2 of the source card is merged into inject 1, so the deck is numbered 1, 3, 4, 5, 6. One full brief at the start, then a short brief at each inject. New for this card

1The old systemStory clock 13:00

HearsAn old system that was supposed to be switched off has been sending your research data out. The technical team can prove an attacker is using it. Cutting it off will also cut a research collaboration link, and the CTO needs a name. From source card

Ask-gated"How did they get in?" or "What did we agree with the supplier?" CTO: "Through software from one of our suppliers. Ask General Counsel what we agreed with them." (Exhibit A.) "Why is it still on?", "Who owns it?", or the VP R&D's "IT says it's in maintenance" followed by "check it": CTO: "That record says switching it off was postponed to keep research running. It says: the owner has since left, no handover." (Exhibit B.) If nobody has asked by the end of the first question window, ask one seat: "CFO, what do you want to know before you decide?"

The first callA leadership call, not an Executive Decision: the CEO names the executive incident lead, the owner of the old system and the contact for the CSIRT. Anyone may object, which forces a 3-of-4 vote. No roll, a one-minute timer, and it does not count against the three decisions. Ruled If nobody is named, the attacker reaches more research systems: Security one step worse before Decision 1. Assumed

False leadThe VP R&D says "IT says that system is in maintenance." The record is really a decommissioning blocker. The table can ask the CTO to check. From source card

3The price of the linkStory clock 13:30, inside Decision 1

HearsThe attacker also holds an open door into your research environment, left over from the old arrangement. The CTO can shut every way in within the hour, but the research collaboration link goes dark with it. From source card

Two pricesVP R&D: "Every day that link is dark, we lose ground we cannot win back, and our stakeholders will ask why." CTO: "Every hour it stays open, the attacker can keep reading." The table is asked how long research may be exposed, and how long it may be dark.

False leadThe research lead's comfort: "It's probably just the quarterly refresh." It is a bias trap: that project is documented and separate, and the data is going somewhere new.

ThenCall Executive Decision 1.

4The cost and the clockStory clock 14:00, Decision 2

HearsCore research data has been leaving for weeks, in small quantities that looked routine and that nothing flagged. From source card

NPCCTO: "My team cannot put its hand on its heart that the research environment is clean for at least a day on our own." General Counsel: "Whether this triggers a duty to notify anyone depends on our sector and jurisdiction. I will have an assessment before you speak to stakeholders. Do not call this 'not notifiable' until I do."

Table questionWhose time, and what exposure: certification is much faster if the integration team is pulled off integration, but the integration work slips. If Decision 1 cut the system off, the leaking has stopped and the CTO says so, but still cannot promise there is no other way out. If not, the CTO says more is leaving now.

ThenCall Executive Decision 2. Inside its timer: the restart vote and the consultant offer.

5It is a campaignStory clock 14:30, Decision 3

HearsThe CSIRT confirms at least three other life-sciences victims in six months and asks BioGenix for its findings so it can warn others. From source card

TensionSharing helps the sector, but the findings expose BioGenix's own weaknesses, recovery work competes for the same people.

Red flagNo single owner for CSIRT coordination. From source card

ThenCall Executive Decision 3. At the end of play the CEO writes one name in the Decision Record: who is accountable for fixing what this showed, and by when. It is not a condition of containment.

6The pivotStory clock 15:00

HearsOnly what the table actually achieved, narrated by you in two sentences: the ways in that were shut, whether the leaking has stopped, and what is still open.

ContainmentYou declare it. Ruled You declare it only after Decision 3 has resolved. This card's test: two marks are set, Ways in shut and Leak stopped; they are necessary, not sufficient. Assumed If they are not when you call time, the verdict says "not yet reached" and the cost sentence is read.

Executive Decisions

Timer adds pressureDeciding under pressure is a skill, and a real incident does not wait for consensus. A visible timer runs for every Executive Decision. Ruled Its length is yours to set; this card uses 3 minutes. IM ruling space

The timer covers deliberation only: NPC questions (at most two, one-line answers), one sentence of position from each seat, the triangle allocation, the CISO's one sentence and the vote. It pauses while you read the brief or narrate.
Each executive speaks once, one sentence, in turn. Call half time once, and the vote with about a minute left. Votes are cast together.
A tie fails. The table may re-propose once while time remains. A vote in progress at expiry is completed.
If the timer runs out with no majority, say "no resolution" aloud. The decision is spent and counts against the three, and the wait option applies automatically with its cost and its complication, unrolled and unshielded, with no vote. Ruled Choosing to wait on purpose is the same option and needs a majority as usual.
Before each vote the CISO states one sentence: "we are deciding X because we know Y and do not know Z".

Assumed All durations are untested. The timer is a pacing tool, not a score. In the debrief ask what the pressure did to each decision, and what the table would have decided with ten more minutes.

The three Executive Decisions

Ruled The menus are fixed by this card. New for this card A "+1" is one step worse on the risk board; the costs, roll targets and complications are printed on the option cards, so you never judge difficulty on the day. For each decision: read its brief, start the timer, let the table set the triangle and vote, roll only if the outcome is in doubt, then narrate and move the board.

1What stops today, and what exposure do we buy?Timer: 3 minutes

Held by the CIO. The technical team keeps a copy of the evidence in every option; the table decides how long research stays dark or exposed. New for this card

Dark now. Research is paused today on everything that depends on the link, and the technical team shuts every way in.

Cost on the boardFinancial +1 now; Reputational +1 when Decision 3 resolves, unless Decision 3 is Open
Roll targetnone if an owner was named in the first call, else 10+
ComplicationFinancial +1 (the shutdown breaks more of the link)

A bounded exposure window. The link stays open under watch for one hour of story time, ending before inject 5, while the technical team builds a temporary link.

Cost on the boardSecurity +1
Roll target10+
ComplicationSecurity +1 (the attacker reads more research data)

Wait for the temporary link, no limit. On the menu because real teams choose it to protect research. Wait option

Cost on the boardSecurity +2
Roll target15+, it goes against the CTO's stated fact
ComplicationSecurity +1 and Financial +1 (the attacker finishes copying the most valuable data)

Triangle tensionTime (shut them out) against Money (protect research continuity).

MeanwhileAt half time CTO: "The attacker still has a door into the research environment while you talk." VP R&D: "Every day that link is dark, we lose ground we cannot win back."

2Whose time, and what exposure do we carry?Timer: 3 minutes

Held by the CFO. Inside this timer sit the restart vote and the consultant offer. New for this card

Pull the integration team off integration and onto the response. Certification takes hours, not a day.

Cost on the boardFinancial +2, and the integration work slips a week
Roll targetnone, the CIO has clear ownership
Complicationnone

Authorise emergency budget and overtime and keep the integration work on schedule. Certification takes about a day and a half.

Cost on the boardFinancial +1
Roll target10+
ComplicationReputational +1 (overtime burns out the team and certification slips)

Run it with the internal team only. Certification takes more than a day; the research environment stays offline longer. Wait option

Cost on the boardReputational +1
Roll target10+
ComplicationReputational +1 (a stakeholder calls the CEO before certification)

Restart before certificationA leadership call, voted 3 of 4, not counted against the three decisions. "Do you reopen research before it is certified?" Yes accepts the technical team's stated risk. Roll target 15+; if it lands, Financial one step better (not below Steady); complication Security +1. Assumed

MeanwhileAt half time the IM reads the CFO's line: "Every day the integration team stays off integration costs us money and a week of slippage." CTO: "I cannot certify the research environment is clean for at least a day on our own."

3What do we say, to whom, and when?Timer: 3 minutes

Held by the CISO, who speaks for the CSIRT; General Counsel gates what may be shared. One stance, one vote, one roll. New for this card

Open. Share the findings with the CSIRT now with stated confidence, tell stakeholders now with a calibrated statement, and send the supplier a formal demand for an explanation.

Cost on the boardFinancial +1
Roll target10+
ComplicationReputational +1 (a later scope revision hurts credibility)

Measured. Share a validated subset with the CSIRT, tell stakeholders once the scope is firmer, and ask the supplier for a call.

Cost on the boardReputational +1
Roll targetnone if the CSIRT contact was named in the first call and General Counsel confirmed what may be shared, else 10+
ComplicationSecurity +1 (the subset omits something the CSIRT needed)

Hold. Say nothing until the investigation completes. Wait option

Cost on the boardReputational +2
Roll target15+, General Counsel already said the CSIRT will assume BioGenix is withholding
ComplicationReputational +1 (the CSIRT escalates its request)

MeanwhileAt half time General Counsel: "If we say nothing, the CSIRT will assume we are withholding. If we say too much, I cannot take it back." A table that wants a hybrid records it as a dissent on the card; it is not a menu item.

Secrets and exhibits

The layers are for the debrief. Never state them. The table meets them only as management documents and people's words, handed over when a player asks. If a table never asks, do not give: show the exhibits in the debrief and ask what they say. New for this card

ASurface secret

Fast-track exception

BioGenix let a supplier's software in under a fast-track exception and never checked it independently.

Exhibit AThe supplier fast-track exception record. Give it when someone asks "how did they get in?" or "what did we agree with the supplier?".

BDeeper secret

Nobody owned the trade-off

An old system stayed on the network for 18 months because a research link depended on it, and nobody owned that call.

Exhibit BThe integration steering minutes: "keep the research link alive until migration completes; decommissioning deferred, the owner has since left, no handover". Give it when someone asks "why is that system still on?" or "who owns it?".

CRoot secret

Speed again and again

In the months after the merger, speed and continuity were chosen again and again, and no executive owned the accumulated risk.

Exhibit CThe record that the switch-off was deferred, with the owner gone and no handover. Debrief only, or if someone asks "was this the only one?".

The root layer is not reachable within the timers. The project owner's note and the CSIRT's request are not secret exhibits. The debrief steers to the organisation's decision record, never to blaming a player.

The panic-hired consultant

Ruled After the CTO's estimate at inject 4 the table may buy outside help, once, inside Decision 2's timer, by majority vote. It is not one of the three Executive Decisions. Before the vote, read the cost aloud, flat: "a new, uncontracted emergency engagement; it cannot contribute inside this window."

Condition · hurts

Panic-hired consultant

Financial one step worse from purchase to the end of the session. No countdown, no benefit. The triangle is untouched, and Money cannot shield it away.

No countdown Ruled

Narration

Why it hurts

Help bought in the middle of an incident cannot onboard inside the window. If nobody buys it, that is a defensible call and debrief material: "who was tempted, and when?" Never bait a purchase through urgency.

Rules this card assumes

The mechanics themselves are ruled in the guide. These are the working defaults this card runs on, so you can run it. Each can change without touching the story, and the IM can rule differently. IM ruling space

Risk triangleRuledMoney protects Financial, Time protects Security, Quality protects Reputational. An arm at 7 or more cancels one step of a printed cost on its paired risk; an arm at 2 or less adds one step to it, once per decision. Every shield costs a starve. The triangle returns to 4, 4, 4 after each decision.
Printed costsRuledA printed cost applies on every outcome. Shields cancel printed cost steps only, never complications.
Partial and failureRuledA partial result (within 3 below the target) gives the intended outcome plus the option's complication told as a story beat, as in vanilla, with no board move. A failure (4 or more below) moves the board by the complication in full and delays the outcome. Assumed The delay is one decision; after Decision 3 the table reads the outcome in the debrief.
BackersRuledEach other seat that backs the option with a concrete commitment adds +1 to the roll, up to +3.
SpecialtyRuledEach seat has three strengths on its role card, graded +3, +2 and +1, as in vanilla. The seat that proposed the carried option adds the one that fits. It stacks with backing. Assumed The grades are defaults. Option cards do not name a specialist seat; you rule it on the day.
Containment testAssumedTwo marks on the board, Ways in shut and Leak stopped, set by Decision 1. You declare containment after Decision 3 has resolved, and only when both are set. A table that finishes early fills the Decision Record. The remediation owner is not a condition.
Critical riskRuledA risk that reaches Critical is announced at once with a concrete symptom. Financial at Critical triggers one forced beat: an emergency board call, one sentence from each executive, and play runs on.

Close and debrief

Ruled Close with the two-part verdict, not a score: whether containment was reached, or not yet reached if you called time first, and one sentence on the cost read off the risk board. If a risk is at Critical, say so. Then debrief as a guide, never a judge. The plan allows about 13 minutes. Assumed

Out of character, 3 min. "Let's step out of the room for a moment." A 30-second check-in: "How was that clock?"
Reveal, 3 min. Lay out Exhibits A, B and C and the real timeline. "What happened", never "what went wrong".
Each seat, 3 min. Each seat speaks once: "Did your decisions reduce the risk you named at the start, accept it or trade it for another, and which decision did the clock change?"
Process gaps, 2 min. "Who owned the old system in your organisation?" "Which decision should have been prepared before this meeting?" "Who else outside the room needed to know: the board, the CSIRT, the stakeholders?" Why did "it's just the refresh" feel convincing?
The Decision Record, 2 min. Fill in the Decision Record sheet, or lay the decision cards out in order beside it: an incident name, the decisions taken and what each cost, the secrets found and missed, the verdict, and one "when X, I will Y" per player with a deadline. The CEO writes the remediation owner.

What the IM must not do

Describe technical detail the table must act on.
Decide for the table.
Let an NPC vote or choose.
Adjust a roll for a nicer story.
Declare containment before the last Executive Decision has resolved, or before both marks are set.
Steer the debrief to blaming a player.

Derived from the vanilla Winnti scenario card (BioGenix), script v0.35 and card texts v0.2. The mechanics come from core/rulings.md.