Facilitator Notes & Model Responses — Lesson 15
For instructors · Strong plays, common mistakes, and model hotwash
Model responses by inject
| Inject | Strong play | Common mistake |
|---|---|---|
| 1 · Urgent call | Refuse the channel; verify on an independent number + code word; default "no" if unverified | Paying, or "asking a question only they'd know" — both defeated by a prepared clone |
| 2 · Inside signal | Reversible restriction + monitoring; evidence vs inference; no public accusation | Publicly accusing the staffer, or freezing entirely while the intrusion spreads |
| 3 · Lock-out | Direct not do; contain vs preserve; pay/no-pay by policy, backups, legal/sanctions | Improvising the pay decision on the ransom amount or the board's instinct |
| 4 · Abroad | Assume compromise; quarantine/rotate; PACE fallback; weigh personal safety | Assuming "probably fine"; having no alternate channel to the principal |
| 5 · Story breaks | Calibrated uncertainty: known / unknown / being done; no premature attribution | Naming a state under pressure, or saying nothing at all |
Why the two poll answers are C
- Inject 1 → C: only an independent channel plus a pre-agreed secret defeats a live voice-clone; caller ID and "insider details" can be faked or known.
- Inject 3 → C: a sound ransom response is determined by pre-set policy, tested backups, and legal/sanctions position — not the amount, the deadline, or the board's instinct in the moment.
Model hotwash
A strong debrief concludes that the teams which coped best were not the cleverest in the moment but the ones carrying prior decisions: a verification rule, a pay/no-pay policy, a PACE plan, tested backups, and a real crisis roster. It ends with three concrete, owned, dated actions — typically closing the exact gaps the injects exposed. Keep it blame-free; the goal is a better next incident, not a verdict on this exercise.
Homework — what good looks like
Task 1
Honest reviews identify a specific moment where preparation (or its absence) was decisive, not a general "we did okay."
Task 2
The best submissions convert felt discomfort into three specific, owned, dated fixes.
Task 3
A real date and facilitator turn "we should rehearse" into a scheduled control.