The exercise

An interactive incident response simulation where I played the company's CTO during a live incident. I had to gather information from the technical team, decide how to respond, and then write the public statement.

How I handled it

I held off on decisions until I had the facts, and let the technical people do the technical work. One person kept insisting it wasn't an attack but had no evidence, while others brought solid evidence, so I steered by the evidence. The simulation scored me 19 of 19 on the critical information gathered.

What I took away

Writing the public statement was the hardest part: answering the question without revealing too much. Looking back, I'd also cut the part that leaned toward blaming our hosting provider.