You’re the CIO of a mid-sized company. It’s Saturday morning, systems are down, and nobody can tell you
why. In this hands-on workshop, you take the helm of the victim organization and live through an incident
from the inside — not as a forensic exercise, but as the operational and human scramble it really is.
Working in small teams, you’ll get a network diagram, a set of backups you think you have, and 30
minutes to make sense of what’s happening and produce a plan. Then we start asking the questions that
hurt: Who’s talking to the press? Do you have legal counsel on retainer? What do you tell the journalist
who just got tipped off by someone inside? Where’s the documentation you needed an hour ago? Injects
land in real time and the picture keeps changing. In the final segment we debrief together and connect
every painful moment back to the controls, documentation, and incident response plans that would have
made it easier — drawing on established response frameworks and public playbooks you can take home
and use. Come prepared to decide under pressure. Facilitated by two practitioners who have run and
lived through the real thing.

What participants will take away
1. Where preparation actually pays off — documentation, asset inventory, and tested backups stop being
abstractions the moment you need them and don’t have them.
2. The crisis behind the incident — technical containment is only half the job; press, legal, executive, and
client communications run in parallel and on a faster clock.
3. How to think under capacity overload — recognizing when the team is past its limits, and what to triage,
delegate, or escalate.
4. Decision-making with incomplete information — practising the calls you’ll have to make before you have
the full picture.
5. A concrete set of resources — response frameworks and public incident response playbooks, mapped to
the specific questions the drill raised.

Who it is for
Open to the full BSides audience — analysts, engineers, consultants, GRC, and managers. No prior incident
response experience is required, and the exercise is deliberately not deeply technical: the skills practised here
are the ones that matter as participants move into leadership roles where an incident becomes a business crisis.
Analysts get a preview of the decisions their future selves will make; managers and executives get repetitions
they rarely get outside a real event.