Cascade Incident Lab
One phished login becomes a cloud intrusion, a customer-data theft and an extortion demand. Make up to twelve scored decisions across the identity, cloud and data-breach playbooks and the master plan, and see exactly where each one hands off to the next.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
One phished login at Harbourline Outfitters becomes a cloud intrusion, a customer-data theft and an extortion demand. Make up to twelve decisions as the incident unfolds. Each step is labelled with the playbook that owns it, so you can see where the identity, cloud and data-breach playbooks hand off and where the master plan takes over. Weak calls open extra steps: the attacker keeps the access you did not close. Running it with a class? Project it, let teams commit to a choice before you reveal the feedback, and spend the debrief on the hand-offs.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
What this template gives you
- A multi-domain incident that cascades: identity compromise → cloud persistence → data breach → extortion, clocks and communications.
- Every step is labelled with the playbook that owns it, so the hand-offs between playbooks and the master plan are visible.
- Weak calls open extra steps — the attacker keeps the access you did not close. A clean run is nine decisions; the longest is twelve.
- Built for a classroom or a team tabletop: project it, let teams commit before revealing the feedback, then export the debrief.
Frequently asked questions
How do I run this lab with a class or team?
Allow 45 to 60 minutes. Project the lab, split the room into teams of three to five, and give each team two minutes per step to commit to a choice before you reveal the feedback. Ask the team that chose differently to explain why. Pause at each change of playbook label and ask who in your own organisation would own that step. Finish by exporting the debrief and listing the hand-offs that caused the most disagreement — those are the gaps to fix in your plan.
Why does the lab follow one incident through several playbooks?
Real incidents rarely stay in one domain. A stolen login becomes a cloud problem when the identity can reach the console, and a data breach when the cloud access reaches customer data. A master incident response plan with domain playbooks works only if the hand-offs between them are clear, and this lab is designed to test those hand-offs.
Are the notification deadlines in the lab accurate?
They reflect the published rules in plain words: GDPR requires notice to the supervisory authority within 72 hours of becoming aware of a personal-data breach; Australia's Notifiable Data Breaches scheme requires an assessment within 30 days and notification as soon as practicable; a US-listed company files SEC Form 8-K Item 1.05 within four business days of determining an incident is material; US state deadlines vary. Your own obligations depend on your facts, so check with counsel.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.