A live, facilitated tabletop that puts every lesson to the test. You will decide under a ticking clock, with incomplete information, as the crisis escalates on several fronts at once.
Day 3CapstoneTabletop
Notes: Facilitator: set the tone. This is decision practice, not a test of technical knowledge. Everyone participates; the scribe captures decisions and the reasoning behind them.
Lesson 15 · Slide 2
How this runs
Facilitator reveals each inject and starts the clock
Participants decide as a leadership team — out loud
Scribe records the decision and the reasoning, not just the outcome
When the timer ends, the team commits — no perfect information is coming
The rule
You may not "wait and see" past the clock. Deciding under time pressure is the whole point (Lesson 13).
Notes: Reveal each. Enforce the clock strictly — it manufactures the pressure that reveals real decision habits.
Lesson 15 · Slide 3
The organisation: Aegis Group
Aegis is a high-sensitivity organisation making contested decisions. You are its senior leadership. It is late afternoon on a Friday. Several of your principals are travelling. The events that follow arrive over the next ninety minutes.
Your standing context
You have backups (last restore-tested "a while ago"), a crisis team on paper, and a board that will want answers fast. Attribution, as ever, will be contested.
Notes: Establish just enough context to make decisions real. The "restore-tested a while ago" and "crisis team on paper" are deliberate weaknesses to surface.
Lesson 15 · Slide 4
The arc ahead
The crisis will escalate across several fronts. Press → to preview the shape — then we run it live.
Deepfake request
→
Account compromise + insider signal
→
Ransomware + data theft
→
Kinetic complication abroad
→
Media & board pressure
Notes: Reveal the arc so participants feel the multi-vector nature, then collapse it and run the injects one at a time. The ransomware node is the peak crisis.
Lesson 15 · Slide 5
Inject 1 — The urgent call
Your finance director receives a call. The voice is unmistakably the CEO's, travelling abroad, demanding an urgent payment to "secure a deal" in the next few minutes. Press → for the pressure cues.
The "CEO" cannot take a callback — "about to board"
Details are plausible; the deal is real and known internally
Finance is nervous about defying the CEO
Notes: 90-second clock. Watch for the verification rule (Lesson 09). The "can't take a callback" is the tell. Push finance's fear of authority as the real vulnerability.
Lesson 15 · Slide 6
Inject 1 decision: what does the finance director do?
C. This is Lesson 09 live. The voice is likely cloned; "can't take a callback" is the tell. A and D act on an unverified channel; B can be defeated by a prepared adversary or a live clone. Only C moves to a channel the attacker does not control and requires a pre-agreed secret.
Notes: Reveal after the team commits. Reinforce: the defence never relied on recognising the voice. Note whether the team had a pre-agreed challenge — most will not.
Lesson 15 · Slide 7
Inject 2 — Something's inside
Security flags unusual access on a sensitive system: a valid account acting oddly, plus large downloads by a long-tenured staffer who was recently passed over. Press →.
Is this the deepfake actor already inside, or an unrelated insider?
Acting rashly on the staffer risks a false accusation (Lesson 06)
Doing nothing risks an active intrusion spreading
Notes: 120-second clock. Watch for evidence-vs-inference discipline (Lesson 13) and proportionate insider handling (Lesson 06). Reversible protective steps (restrict access, monitor) beat both paralysis and accusation.
Lesson 15 · Slide 8
Inject 3 — The lock-out
Systems begin encrypting across Aegis. A note demands payment and claims a large volume of sensitive data is already stolen. This is the peak of the crisis. Press →.
Backups exist but were last restore-tested "a while ago"
Double extortion: paying will not un-leak the stolen data
Operations are degrading by the minute; the board is calling
Notes: 180-second clock — the peak. Watch for direct-not-do leadership, contain vs preserve, and whether pay/no-pay is treated as pre-decided policy (Lesson 12). The untested backup is the recurring wound.
Lesson 15 · Slide 9
Inject 3 decision: what most determines your response to the ransom?
C. Lesson 12 live. The amount (A) and the board's instinct (D) are pressure, not the driver; B is one input. What determines a sound response is what you decided in advance — policy, restorable backups, and legal/sanctions position. Deciding now, under duress, is the failure mode the attacker engineered.
Notes: Reveal after commitment. The teaching point: if the backup posture and policy weren't set before today, the team is improvising — which is exactly the lesson.
Lesson 15 · Slide 10
Inject 4 — Complication abroad
One travelling principal reports their work laptop was out of their sight for an hour at a hotel — in a higher-risk jurisdiction — just as the intrusion began. Now they cannot reach the secure channel. Press →.
Is the travelling device the way in? (Lessons 07, 08)
Your comms plan is being tested — do you have a PACE fallback? (Lesson 09)
A person's safety, not just data, may now be in play
Notes: 120-second clock. The kinetic element raises the stakes beyond data. Watch for custody/quarantine instincts (Lesson 07) and whether a PACE plan exists to reach the principal.
Lesson 15 · Slide 11
Inject 5 — The story breaks
A journalist calls: they have the leaked data and a source blaming a named state. The board demands a public statement within the hour. Attribution is unconfirmed. Press →.
Public attribution is an irreversible, one-way door (Lesson 13)
Silence and over-claiming are both dangerous
What can you say that is true, calibrated, and defensible? (Lessons 02, 13)
Notes: 300-second clock — the longest, because this is a strategic communication under contested attribution. Watch for calibrated uncertainty ("what we know / don't / are doing") over false precision or naming a state prematurely.
Lesson 15 · Slide 12
The clock was always the adversary
Every inject pushed you to decide before you were ready
The strongest teams relied on decisions already made — policy, PACE, verification rules
The gaps you felt are your real action items
The lesson of the tabletop
You cannot out-think a crisis in the moment. You can only arrive with the decisions, plans, and rehearsals already in place.
Notes: Reveal each. Transition to the hotwash. The point: preparation, not brilliance, is what carried the strong teams.
Lesson 15 · Slide 13
Hotwash — the after-action review
What went well? Which prior decisions saved you time?
What hurt? Where did a missing plan cost you?
What surprised you? Which assumption proved false?
What changes on Monday? Three concrete actions, with owners
Notes: 300-second clock for a structured debrief. The last question is the deliverable: three owned actions. Blame-free — the culture point from Lessons 04 and 06 applies to the review itself.
Lesson 15 · Slide 14
Close & what's next
You exercised the whole course under pressure, on several fronts at once
Your felt gaps are the honest input to your action plan
Rehearsal is a control — schedule the next one
Next
Lesson 16 — Horizon Scan & Action Planning: turn three days into a 30/60/90-day plan.
Notes: Bridge to the finale: the tabletop surfaced the gaps; the wrap-up converts them into a committed plan.