Read each inject aloud. 15 minutes each. Every answer needs a person + a place.

Inject 1 (0:05)

"EDR alerts on 3 machines. Encryption in progress. It's 2 AM Saturday."

• Who receives that alert in reality — a name, not a team? (Test it after the exercise!)
• Who wakes whom — where does the call tree live?
• What is our FIRST isolation action, and who takes it?

Inject 2 (0:20)

"It spread. The backup console is unreachable. Your biggest client is calling."

• Who has network-isolation authority at 2 AM — and do they know it?
• Who owns client comms — one voice, which voice?
• The PTO test: name someone critical. They are now unreachable (cruise, no signal). Proceed without them. Watch what breaks.

Inject 3 (0:35)

"Vendor says 72 hours to restore. The insurer wants a timeline. A reporter emails."

• Who invokes cyber insurance — and where is the POLICY NUMBER, the actual document?
• Who is the authorized spokesperson? What do we NOT say publicly?
• Who calls counsel, and at what trigger?

Curveball (if time)

"The ransom note claims data theft — does that change our legal/notification posture?"

(Pass = the room says "that goes to counsel." Knowing WHO decides is the answer; deciding it yourselves in a conference room is not.)