Facilitator guide

Breach Inc. works well played alone, but works best when a leadership team plays it and then talks about what it would mean for them. This guide is for whoever runs that session: a CISO, a head of risk, a chief of staff or an L&D lead. You don't need to be a security expert.

What players go through

Players are a newly promoted security leader at ACME Inc., a fictional payments processor, through a major data breach: the weeks of secrecy before the announcement, the public fallout and the aftermath. Each decision takes days and moves four things: their influence, their team's health, their own health and, once the breach is public, public trust. At the end, the game shows how their choices played out, with lessons and questions to take back to their own organisation.

One playthrough takes about 35 minutes. There are no right answers, and different choices lead to different events and endings.

Choose a format

• Play first, then talk (recommended), 60 minutes together. Everyone plays alone in the week before, and brings their ending and their list of questions. The session is all discussion. It suits busy executive teams, and nobody's choices are made in front of their boss.
• Play together, 90 minutes. One screen, one facilitator. The room discusses each decision and votes, and the facilitator clicks the majority choice. Stop at the pause points below. It suits teams who'd respond together in a real incident.
• Board briefing, 45 minutes. Board members play alone beforehand. In the session, take pause point 4. The session deck adds questions written for boards. To record the session as evidence of board training or exercising, see how Breach Inc. maps to cyber security standards.

Before the session

• Send the link, breach-inc.com, with the time it takes and a note that it's fiction based on a real experience. It runs in any browser, with no account or download.
• Ask players to use Email me the questions or Print or save as PDF on the last screen, and bring their list.
• Find your own incident response plan, crisis communications plan and any contracts for outside help (forensics, legal, contact centres). You'll compare the game with them.

Pause points

If you're playing together, stop at these points. If players played alone, use them as the agenda, in order.

1. After "The Briefing Room" (end of Act 0)
2. After "How Many People?" (end of Act 1)
3. After "The Share Sale"
4. After "The CEO's Words" (end of Act 2)
5. After the ending

The full facilitator notes and the session deck, with questions and conversation points for each pause point, come with an organisation licence.

Closing the session

End with actions, not impressions. Take the questions the group found hardest to answer, usually three to five, and agree for each one:

• What we'll find out or change, in one sentence.
• Who owns it: one named person, not a team.
• When it's due, and where it will be reported back.

A good test of the session: a month later, can someone answer one of those questions who couldn't before?

Adapting it for your organisation

Under the free licence, the game is used as it is, and you're welcome to change this guide's timings for your own sessions. For a learning platform package that records completions, a ready-made session deck, or to adapt the game itself, for example with your own escalation names, playbook links or a translation, see the organisation licence.

Questions or feedback from running a session are very welcome: email me.