Incident readiness · Fictional tabletop & training design
Security Awareness & Incident Response
A simulated account-compromise response exercise and awareness training plan.
A simulated third-party support-account incident with evidence-based triage, containment decision trees, response playbooks and role-specific security-awareness materials.
- My contribution
- Designed incident response and awareness exercises
- Evidence / output
- Six tabletop injects and four training modules
- Scope
- Fictional, undelivered training
Repository updated · Snapshot checked 6 Nov 2026 (UTC)
11Synthetic incident events
06Tabletop injects
04Awareness modules
01 / CONTEXT
Project context
Operational incident handling requires timely action without overclaiming evidence. The scenario tests how responders would preserve logs, coordinate with a vendor, request approval and communicate uncertainty.
02 / EXECUTION
What I did
- Mapped eleven fictional timeline events and ten evidence references, including missing evidence.
- Designed eight proposed response decisions and ten open actions without pretending implementation.
- Expanded six tabletop injects into safe/unsafe decision branches and eight evidence challenges.
- Built four employee-awareness modules, eight knowledge questions and model answer scoring.
03 / VERIFICATION
Evidence and outcomes
- The exercise differentiates suspicious ticket activity from confirmed data exfiltration.
- Model scoring is reproducible and explicitly not a measured employee outcome.
- Decision, evidence and corrective-action references are validated.
Full documentation and source files are in the public GitHub repository.
04 / LIMITATIONS
Limitations
Scope
Simulation only: no genuine incident, vendor access, live containment, delivered training or real employee assessments.