Malware & Management: the Incident Master’s guide

You are learning to run Malware & Management at a table. This guide explains every mechanic, in the order you need it. Where the rules are settled, they are marked as rules. Where they are not, the decision is yours, because the IM is always the ruling authority.

Ruled decided by the game's authorIM ruling space you decide at the tableAssumed default a starting point, not a rule

You run the whole thing

A session has five parts. This is the whole game in one line.

Prepare the tableBrief the tableRun each injectDeclare containmentVerdict and debrief

Nobody else is going to run it. From the first minute to the last, you do.

Safety and the stop. Read the opening sentence on the safety page before the first brief, and leave the page on the table. Anyone may stop the game with one word, at any point, and the stop is never overruled. The page is safety-and-x-card.qmd: what to say, what the stop does, what is out of bounds at the table.

First-order rules

The eight things that hold in every session.

1 Objective

Contain a fast-moving malware incident by resourcing, authorising and defending your technical team's response, before it spreads and before the business pays more than it can afford. Ruled

2 Executives decide

The player always decides. When the outcome is in doubt, a d20 against the printed target decides what it leads to. Ruled

3 Three risks

Security, Financial and Reputational on a visible board. The scenario card says which matters most. Time is the clock, not a risk. Ruled

4 Executive Decisions

At most 3 per game, from the card's menu. A strict majority carries; a tie fails. The IM chairs. Ruled

5 Risk triangle

12 points, 4 each: Money, Time, Quality. A point is what the table protects. Spending money is never the goal. Ruled

6 Timer adds pressure

Every Executive Decision runs against a visible timer. Deciding under pressure is the skill, and the hour is short. Ruled

7 Lasting effects

Cards for a lasting effect, tracked by the IM. Some help, some hurt. The panic-hired consultant only costs. Ruled

8 How it ends

The IM declares it and the game ends. No score: containment reached or not, and what it cost. What is unruled, you rule. Ruled

Start with these eight. The rest of this guide fills in the detail, and wherever the rules are open, you rule.

The session, step by step

What you do in each part, and what to try when the table stalls.

1 Prepare

Pick the scenario card and read it once.
Seat the four fixed roles; decide who plays the NPC functions.
Know which Executive Decisions the card offers.

2 Brief

State the objective.
Deliver the Escalation Card's full brief.
Ask the CISO player for the 30-second summary.
Name the risk the card puts first.

Table silent? IM tipAsk each seat once what it needs to know.

3 Run each inject

Run the loop below for each inject.
Deliver injects as the incident develops.
Call an Executive Decision when the card offers one.

Talk circling? IM tipAsk what they actually decide, or deliver the next inject.

4 Contain

When the last Executive Decision has resolved and you judge the incident contained, say so.
The game ends there.

Running long? IM tipAbout an hour is the target. The call is yours.

5 Close

Give the closing verdict on the three risks. No score.
Debrief: what failed was process and leadership, not the tool.

Short on time? IM tipKeep the debrief short, not skipped.

Who is at the table

Ruled Four seats decide. You rule, and you play the NPCs.

Incident MasterRuling authority

Four seats

They vote

CEOCFOCIOCISO

NPCs

Non-player characters, played by the IM. They advise, never vote.

General CounselHead of CommunicationsCOOChief Risk Officer

How a session runs

One full brief, then a loop for each inject, until you declare containment.

One full brief

Short brief at each inject

Executive Decisionat most three per game

Move risk board

Roll only in doubt

IM declares containment?

Two-part verdict

no doubt

in doubt

no, next inject

yes

Ruled The roll happens only in doubt. Assumed The order of the loop is a walkthrough default.

The mechanics in detail

Eight topics. Each tells you what is ruled and what is yours to rule.

Authority and ending

Ruled The Incident Master (IM) is the ultimate authority at the table. The IM runs the scenario card, rules on what happens, and declares containment. The game ends the moment the IM declares containment, which happens only after the last Executive Decision has resolved, and a session lasts about an hour.

Ruled The objective the players share: contain a fast-moving malware incident by resourcing, authorising and defending your technical team's response, before it spreads and before the business pays more than it can afford.

The ruleThe IM declares containment, and the game ends there. There is no score; the IM gives a two-part verdict instead: containment reached or not, and what it cost.

IM ruling spaceThe exact wording of the closing verdict, and where play stops if the hour runs out before containment.

The table and the NPCs

Ruled Four seats are always filled: CEO, CFO, CIO and CISO. The CIO is a core seat because containment happens in IT, and the CIO and CISO are two distinct seats.

CEOCFOCIOCISOGeneral CounselHead of CommunicationsCOOChief Risk Officer

Ruled The other four functions are non-player characters (NPCs), played by the IM when no player holds them. They give facts, advice when asked, questions and pressure. The standard table is four seats. A fifth to eighth player turns one of them into a seat, in this order: General Counsel, Head of Communications, COO, Chief Risk Officer. A converted seat votes and backs like any seat, with no specialty strengths.

The ruleIM-played NPCs never vote, never decide and never roll.

IM ruling spaceWho plays them well, how much pressure they apply, and whether to hand the board markers to a player.

The card and the three risks

Ruled Three risks are visible to everyone at the table. The IM reads from the scenario card which of them matters most.

SecurityRisk

FinancialRisk

ReputationalRisk

Ruled Regulatory exposure is a marker on the scenario card, not a fourth risk.

RuledEach risk has four steps: Steady, Strained, Serious, Critical, all starting at Steady, on a printed risk board with three markers. You move a marker aloud after each decision and say why. A risk reaching Critical is announced at once with something the table can see, never banked silently. Financial at Critical triggers one forced beat: an emergency board call, one sentence from each executive, and play runs on. How a card's regulatory marker changes play is yours to rule.

The inject loop and the roll

Ruled The player always decides. The d20 decides what the decision leads to. A good roll is not good leadership, and a bad roll is not a bad decision.

The ruleYou rule on the outcome of the roll. You never rule on the decision.

Do you roll?

No real doubtThe option fits the facts and its groundwork is done. It succeeds, no roll. The stated costs still apply.

In real doubtRoll a d20 against the target printed on the option card: 5+, 10+ or 15+. At the target, the intended result. Within 3 below, partial, as in vanilla: the result happens, plus a complication you narrate as a story beat, with no board move. 4 or more below, failure: the full complication moves the board, and the result is delayed.

BackingEach other seat that backs the option with a concrete commitment adds +1, up to +3.

SpecialtyEach seat has three strengths on its role card, graded +3, +2 and +1, as in vanilla. If the seat that proposed the carried option plays to one of them, add that number to the roll. It stacks with backing.

Ruled The roll rule, the targets, the tiers, the +1 to +3 specialty bonus and the proposer as acting seat are ruled, though not yet tested at a table. Assumed Which grade each seat holds is a default on the role cards. Targets are printed on the card in advance, so you do not judge difficulty on the day.

IM ruling spaceWhether a roll can be retried, whether an option uses a seat's specialty, who rolls, and any roll outside a printed option. An option that every seat backs and that plays to the proposer's strengths is rarely in doubt: consider ruling it automatic. State the stakes before the roll, rule consistently and say the ruling aloud.

Executive Decisions

Ruled Some decisions are Executive Decisions, made as a board would. There are at most 3 per game, and the menu of them is fixed by the scenario card.

Ruled An Executive Decision is carried by a strict majority of the seats at the table. The IM chairs.

4 seats3

5 seats3

6 seats4

7 seats4

8 seats5

The ruleA tied vote fails, and nobody breaks it, the IM included. The IM chairs.

ExampleFour seats. The CFO proposes taking an expensive option from the card's menu. The vote is 2 to 2, so it fails, and the table must propose something else. At 3 to 1 it carries.

Risk triangle and lasting effects

Ruled A physical triangle holds 12 points: Money, Time and Quality, 4 each. A point stands for what the table protects: Money protects the budget, Time protects speed, Quality protects thoroughness. Spending money is never a goal.

The ruleA starved arm of the triangle costs its paired risk once, standing, when the Executive Decision resolves. It never costs it again.

RuledMoney pairs with Financial, Time with Security, Quality with Reputational. An arm at 7 or more cancels one step of a printed cost on its paired risk. An arm at 2 or less adds one step to its paired risk, once per decision. Every shield costs a starve. Arms run 1 to 8, and the triangle returns to 4, 4, 4 after each Executive Decision.

Ruled Conditions are cards for lasting effects, and the IM tracks how long they last. Some help and some hurt. The panic-hired consultant is a pure cost: it makes Financial Risk one step worse, the triangle is untouched, and spending Money to shield cannot cancel it. On the Winnti card it is bought at most once, inside Decision 2, by majority vote, and it lasts to the end of the session with no countdown.

IM ruling spaceThe size and timing of a helpful condition such as a reputation shield, and how long a condition lasts.

Condition · hurts

Panic-hired consultant

Financial Risk is one step worse from the moment it is bought to the end of the session. The triangle is untouched. Money cannot shield it away.

No countdown Ruled

Condition · helps

Reputation shield

An example helpful condition: it cancels one step on Reputational, until the next Executive Decision resolves. You may change its effect and length.

Lasts to the next Executive Decision Assumed

The Escalation Card and the clock

Ruled The Escalation Card carries a severity cell and a page rule. Start with one full brief for the table, then give a short brief at each inject. The CISO player gives the 30-second summary before every vote.

The ruleThe CISO player gives the 30-second summary. Do not skip it.

IM ruling spaceHow the 24-hour and 72-hour clocks run at a four-seat table, and when each inject lands. Every Executive Decision also runs against a visible timer: deciding under pressure is a core feature, and the hour is short. The length of the timer is yours to rule. On the Winnti card the default is three minutes. Expiry is ruled: with no majority you say "no resolution" and the written wait outcome applies automatically, with no vote and no roll.

Debrief and verdict

Ruled The IM closes the game with a verdict in place of a score. There are no points and no XP. The verdict has two parts: whether containment was reached (or not yet reached if your IM calls time first), and one sentence on the cost, read off the risk board, for example "Security Steady, Financial Serious, Reputational Strained".

Use the debrief to bring out the one lesson the game exists to teach: in real incidents, what fails is usually process and leadership, not the technical fix. Resources and decisions are the added value.

IM ruling spaceThe exact wording, and whether and when to call time.

A decision played through

One Executive Decision, from brief to board, on the Winnti scenario card at a four-seat table. Assumed Every number and outcome below is an illustration. Rule your own game your own way.

The CISO gives the 30-second summary. Ruled

"We are deciding what stops today and what exposure we buy, because we know the attacker is using the old system and we do not know how far they reach." Everyone starts from the same picture.
You start the timer. Ruled

The decision is on the card's menu: dark now, a bounded exposure window, or wait. The CIO holds the Decision Card. Three minutes, one sentence each, no open debate. Assumed
The table sets the triangle: Time 7, Money 3, Quality 2. Assumed

Speed is what they protect. Time 7 will shield Security, Money 3 leaves Financial as printed, and Quality 2 will starve Reputational.
Time 7 · Money 3 · Quality 2
The CIO proposes the bounded window. The vote is 2 to 2. Ruled

At four seats a decision needs 3 votes. A tie fails and nobody breaks it, you included. The table re-proposes once while time lasts and the bounded window wins 3 to 1. Re-proposing once is a default, not a rule.
You check the printed target and roll. Ruled

The option has doubt, so it carries a target of 10+. Two seats backed it with a concrete commitment: +2. The CIO proposed it and rules say it uses what the CIO knows about what a shutdown breaks (Impact, +2). The d20 shows 6, plus 4 is 10, at the target: the intended result. State the stakes first, rule aloud, and tell the holder to tick the Decision Card.
You move the board aloud. Ruled

The printed cost is Security one step worse. Time 7 cancels that step: Security holds. Quality 2 starves Reputational: one step worse, once per decision. Say why for each marker.
Security Steady · Financial Steady · Reputational Strained
If time runs out with no majority: Ruled

Say "no resolution" aloud. The decision is spent and counts against the three, and the written wait outcome applies automatically, with no vote and no roll.

Facts come from the rulings source, core/rulings.md. Where a detail is not ruled it is marked ASSUMED or left as IM ruling space, and the worked example in the chapters is an illustration rather than a replay of a real session.