The scenario explained · one hour, four executives, three decisions
An attacker has been inside a life-sciences company for weeks, and the executives are told at one o'clock. This page shows how the hour runs: what the IM says, what the table decides, and what each choice costs.
Operation Silk Harvest, played at four seats. The planned hour is 56 minutes with the rest as float, sized to the workshop slot. Assumed Every duration is arithmetic and nothing has been timed with real players.
Three Executive Decisions and three leadership calls all use it.
Story time starts at 13:00. The clock is compressed: the story hour is about two, the table hour is one.
StoryRuled: one full brief
The IM puts the Escalation Card on the table with Brief 1, reads the opening, and teaches the rules in 90 seconds. The CISO gives the 30-second summary.
"A national CSIRT called your CISO at a couple of hours ago with a warning about a campaign against life-sciences companies. At five to one your technical team found that you are part of it."
The risk board starts at Steady for all three risks. The IM moves a marker aloud after each decision.
StoryLeadership call
An old system that should have been retired is sending research data out. Cutting it off also cuts a research collaboration link, and the CTO needs a name.
The first call, 1 minute, no roll: the CEO names the executive incident lead, the owner of the old system and the CSIRT contact. No name means the attacker reaches more research systems: Security one step worse.
Players can ask where the way in was. The IM hands over a management document, never a technical artifact.
Executive DecisionHeld by the CIO
The VP R&D prices the dark link, the CTO prices the open door. The table sets the triangle, votes inside a 3-minute timer, and the IM rolls only if the option has doubt.
StoryShort brief
Core research data has been leaving for weeks. The CTO cannot certify the research environment clean for at least a day on our own. General Counsel will not let anyone say "not notifiable" yet.
It follows Decision 1. If the table cut, the leaking has stopped but nobody can promise there is no other way out. If it did not, more data is leaving right now.
Executive DecisionHeld by the CFO
The CFO's pressure line is read once at half time: "every day the integration team stays off integration costs us money and a week of slippage."
Inside the timerThe consultant. The table may buy outside help once, by a vote. It is a pure cost: Financial one step worse to the end of the session, no benefit, no countdown. Leadership callRestart before certification? The table votes yes or no, 3 of 4, once.
StoryShort brief
The CSIRT confirms at least three other life-sciences victims in six months and asks for BioGenix's findings. Sharing helps the sector but exposes your own weaknesses.
Executive DecisionHeld by the CISO
One stance, one vote, one roll. General Counsel gates what may be shared and will not say that holding is safe.
Ruled
After the last Executive Decision, the IM declares containment when the ways in are shut and the leaking has stopped, or says "not yet reached" if the IM calls time first. The verdict is two parts: containment reached or not, and one sentence on cost, read off the risk board.
"Contained. Security Steady, Financial Serious, Reputational Strained."
The CEO writes the remediation owner for the next 90 days. If Financial reaches Critical at any point, the IM calls an emergency board meeting: one sentence from each executive, and play runs on.
Debrief
Five parts, 13 minutes: step out of character and check in, the reveal (the three exhibits and the real timeline), each seat answering once, process gaps and reality, then the Decision Record, which is a one-page sheet: the decisions taken, the exhibits found and missed, the verdict and one "when X, I will Y" per player.
The IM never states these. The table meets them as management documents, handed over only when a player asks. Anything unasked is shown in the debrief.
From script v35. The mechanics come from core/rulings.md.