Start here
Five people, one hour, one printed set. This page is the whole preparation.
Print the sheets from the downloads page. You need the rules sheet and a role card per seat, one decision card per seat, the table artifacts, the decision record, and the scenario card. Bring a timer, a d20, three risk markers and twelve points of Money, Time and Quality.
That is five files to print and some cutting: the decision cards are cut to A6 and folded once, the counters are cut loose, and the risk board wants its background graphics on while everything else prints clean without them. Budget twenty minutes with a guillotine before anyone sits down.
Seat four: CEO, CFO, CIO, CISO. A fifth to eighth player takes over a non-executive function in this order: General Counsel, Head of Communications, COO, Chief Risk Officer. A converted seat votes like any other and has no specialty of its own.
Read the safety page aloud and leave it on the table: this is a fictional company, anyone may stop the game with one word, nobody has to explain why, and nobody is asked to describe a real incident.
Then state the objective, read the Escalation Card, and ask the CISO for the thirty-second summary. The clock starts at the first decision, not before.
Settle how a seat votes when the table is not all in one room. A strict majority carries the option, so a seat that cannot point at a card still has to be counted: it may vote out loud, hand a written slip to a neighbour, or pass its vote to a named delegate before the cards go down. Say which of the three you are using before the first decision, and write it at the top of the Decision Record.
Before the first session
Two diagrams teach the whole thing faster than the guide does: the game explainer shows how a session runs and what you are free to rule; the scenario explainer shows the hour, the options and the secrets.
1
Scenario card read once, roles seated, decisions known. Decide who plays the non-executive functions as characters.
2
One full brief at the start. Objective, escalation, the risk the card puts first. Then short briefs at each inject.
3
Deliver it, take questions, call an Executive Decision when the card offers one. Three decisions at most, each with a visible timer.
4
Only after the last decision has resolved, and only if you judge the incident contained.
5
Verdict in two parts: containment, and one cost sentence read off the risk board. No points, no score.
The table argues about the technical fix. Say what the decision actually is, or deliver the next inject. A table that stalls loses time it will want later, and the timer is the game's only hard pressure.
Nobody wants to spend the Money arm. Remind them that spending money is never the goal: the triangle is about which risk the table protects, not about being efficient.
Someone reads the exhibits early. That is allowed. The exhibits are the truth the table could have had, and reading them early costs the seat that did it the credibility it needs later.
Report a problem
Unclear rule, a sheet that will not print, or a table that ran it and found something wrong: open an issue at codeberg.org/klausagnoletti/malware-and-management and say which version you ran.
Malware & Management, by Klaus Agnoletti. CC BY-NC 4.0.