Nation-State Notification Lab
The FBI calls: a nation-state actor is already inside your environment. Now the hard part — do you wipe and reset tonight, or hold? How do you brief the board on partial, sensitive facts? What do you disclose, and when? Sit in the response and make each call the way a regulator, a court and the notifying agency would judge it — engage counsel and preserve privilege, coordinate before you act, keep sensitive indicators need-to-know, change posture without tipping the adversary, and let attribution follow verified facts. Each decision shows you why.
Pair this drill with the free APT / Nation-State Notification Board Brief — the document that records the briefing you practise here. Educational drill, not legal advice.
The real job. More noise, a tighter clock.
The FBI has just told you a nation-state actor is inside your environment. Work 10 board-room decisions — make the call a regulator, a court and the notifying agency would find defensible, then see why. You are graded on how many you get right against the clock.
What this lab is
- A free, browser-based decision drill for the moment the FBI or CISA notifies you that a nation-state actor (an advanced persistent threat) is already inside your environment: work ~14 board-room decisions on how to respond, brief and disclose.
- The hard part is the first hours — engage counsel and preserve privilege, coordinate with the notifying agency before you act, and do NOT reflexively wipe, reset or go public.
- You practise the real traps: briefing the board with calibrated confidence on partial information, keeping sensitive indicators need-to-know, changing posture without tipping the actor, supply-chain exposure, the narrow AG-driven disclosure-delay path, OT/safety, long dwell time and premature attribution.
- Each decision reveals why the board-defensible answer is right, and you are graded S–D on how many you call correctly against the clock.
- Educational decision drill — not legal advice, and not a substitute for coordinating with law enforcement and counsel. Pair it with the free APT / nation-state notification board brief template.
Frequently asked questions
What is the Nation-State Notification Lab?
A free, in-browser decision simulation that drops you into the first hours after the FBI or CISA tells you a nation-state actor is in your environment. You work through board-room decisions — engage counsel, coordinate with the agency, whether to wipe and reset, how to brief the board, what to disclose and when — and each one has a single board-defensible answer, revealed after you lock in your call.
Why not just wipe the affected systems and reset everyone’s passwords?
Against a patient nation-state actor a sudden mass wipe-and-reset tips them off and destroys forensic evidence before you understand their full footprint. The defensible path is a quiet, coordinated eviction planned with counsel and the notifying agency — preserve evidence, find every foothold, then remove access everywhere at once.
Is this legal advice?
No. The lab is an educational drill, and the regulatory references (SEC Form 8-K Item 1.05, the Attorney General national-security delay, Regulation FD) are summarised for orientation and can change. A real nation-state notification must be worked with qualified counsel and in coordination with law enforcement.
Who is it for?
CISOs, general counsel, incident-response leads, CEOs, disclosure-committee members and board directors — anyone who would be in the room when a government agency calls to say an advanced persistent threat is already inside, and who wants to rehearse the response before it is real.