Use this view live with players instead of consulting the separate cheatsheet.
One Wednesday morning, a staff member receives an email with what appears to be an important HR document. Having recently completed security awareness training, they spot the telltale signs — an unusual sender address and an unexpected attachment - and report it to IT without clicking. The threat is neutralised before any systems are impacted.
Attackers exploit a well-known vulnerability in the outdated software still running across office machines - a flaw that was patched months ago, but never applied here. Cryptocurrency mining malware is deployed across infected PCs, hijacking processing power and grinding systems to a near standstill. The office is forced to shut down while IT teams work to clean and rebuild affected machines. A major loss of business activity follows. The share price crashes.
Could have been prevented by: PC Upgrade
Data from the office server is found for sale on the dark web, including sensitive company information such as emails, HR records, client contracts, and banking details. The breach becomes public, leading to significant reputational damage and a sharp drop in share price.
Could have been prevented by: Server Upgrade, Database Encryption
As it turns out, the previous anomalies in the plant database weren't random. The Mafia has been changing the entries to affect the share price. The business is now being investigated for insider trading - it should have gotten encryption on that database!
Could have been prevented by: Database Encryption
An employee's laptop is stolen from a car. It contains unencrypted client data and internal documents. Regulatory notification is required and share price suffers lightly.
Could have been prevented by: PC Encryption
These events occurred but had no share price impact this round.
All four rounds are complete.
View Full Game Report