Malware & Management: an incident tabletop for executives
A fast-moving malware incident is spreading. Four executives sit at the table: the CEO, the CFO, the CIO and the CISO. An Incident Master runs the scenario and voices the technical team, so nobody at the table fixes anything. The players resource, authorise and defend the team’s response, against a visible timer and a finite budget of attention and money.
The game is about leadership under pressure. In real incidents the technical fix is rarely what fails. What fails is who owns the trade-off, who was asked in time, and who said yes to the shortcut.
It is part of the Malware & Monsters family.
What happens at the table
The scenario is Operation Silk Harvest: a state-linked intruder in the research network of a biotech company. The executives decide where attention and money go, what to authorise and what to defend. The technical team is played by the Incident Master, so the decisions stay with the executives.
No tabletop-game experience is needed. The Incident Master is the ruling authority, and the debrief looks at the trade-offs the table made.
At a glance
| What it is | A tabletop game about executive decisions in a malware incident |
|---|---|
| Players | Four seats (CEO, CFO, CIO, CISO), up to eight with Incident-Master-played seats, plus the Incident Master |
| Length | About one hour: roughly 43 minutes of play and a debrief |
| Who it is for | Security leaders, CISOs and executives. No tabletop-game experience needed |
| You need | Printed sheets, a timer, a d20 and three risk markers |
| Scenario | Operation Silk Harvest, a state-linked intruder in a biotech research network |
| Larger groups | A scaled version for 50 to 60 players at 12 tables |
Want to play it with your leadership team?
If you lead a security team and would like to run it with your executives, get in touch.
