The quiet one — no encryption, no ransom note, just money moving. Minutes matter more here than in any other deck.

Inject 1 (0:05)

"Finance almost wires $48,000 on a spoofed thread. They caught it — this time — and forwarded it to IT."

• Who is the named owner for BEC reports — does finance know that name?
• What's the wire-recall procedure and its REAL clock (bank cutoffs, by name of bank)?
• Does anyone check whether the spoofed thread means a mailbox is compromised — who?

Inject 2 (0:20)

"The CEO's mailbox has rules forwarding mail externally. They've been there a while."

• Who has authority to contain an executive's mailbox — including kicking the CEO out of their own account?
• Where do we look for the same rules on OTHER mailboxes, and who looks?
• The PTO test: the M365/Google admin is unreachable. Proceed.

Inject 3 (0:35)

"Six weeks of exposure confirmed. Client PII was in that mailbox."

• Who determines notification obligations — (pass = "counsel decides, we assemble the facts")
• Who assembles the timeline — where does the scribe's log live?
• Who tells the insurer, and under which policy line?