Organiser guide
Run of show and everything you need to run Breach Room
One incident, four locked rooms, about two hours door to door. Pick your incident below and this whole page — timings, host script and debrief — rewrites itself for it.
An AI support agent is emailing customer records to a lookalike domain after reading a poisoned attachment.
Frameworks: OWASP LLM01 Prompt Injection · OWASP LLM02 Sensitive Information Disclosure · OWASP LLM06 Excessive Agency · MITRE ATLAS: Indirect LLM Prompt Injection · NIST AI RMF
Before the doors open
- Screen, cable and a browser you can leave open for two hours (the big screen never needs to be touched again).
- Strong Wi-Fi: every player uses their own phone.
- Tables of 4–6 with numbers, plus printed Join Kit cards with the QR code and the event code.
- A host with a microphone, and one or two judges if you want human scores.
- A backup event code written on paper in case the screen fails.
Run of show — Helpdesk Hijack
Times are from the moment you press Start. The 30 minutes before that are registration.
- T-60 min
Room and tech setup
20 min · OrganiserBig screen on and set to the join view. Sound checked. Tables set for 4–6 people with table numbers. Wi-Fi password posted on every table and on the screen.
Say this
Nothing yet — house music on, screen up.
Check the big screen
Join view is up, showing the QR code, the short link and the event code. If it says anything else, reopen the display link.
- T-40 min
Create the event
10 min · OrganiserSign in, create the event and choose “Helpdesk Hijack” as the incident. Check the 6-character code and open the big screen with its display link. Print or display the Join Kit.
Say this
Nothing yet.
Check the big screen
The code on the screen matches the code on your Join Kit cards, character for character.
- T-30 min
Doors open, players register
30 min · EveryoneAttendees scan the QR code and register on their phones. Watch the live count on the screen. Teams build themselves as people join.
Say this
“Scan the code on the screen or the card on your table, put your name in, and it will give you a team and a job. Do that now — it takes twenty seconds.”
Check the big screen
Player count climbing and team cards appearing. If the count is stuck, the Wi-Fi is the first suspect.
- T-5 min
Balance teams and seat people
5 min · OrganiserRun auto-balance, rename anything awkward, move latecomers into short teams, and ask each team to sit together.
Say this
“Find your team name on the screen, go sit with them, and check your phone shows your job title. If it doesn't, put your hand up now.”
Check the big screen
Every team card shows 4–6 players and no team is left with one or two people.
- 0:00
Welcome and rules
5 min · HostSet up the incident at Harborlight Credit Union, explain the four rooms, that each person sees different evidence, and that only the Incident Commander submits. Then press Start.
Say this
“Harborlight Credit Union's AI support agent, Beacon, is sending customer records to a lookalike domain. The leak is active. You are the response team. Four rooms, about forty-five minutes. Look at your own phone — you each see different evidence. Say what you see out loud. Only the Incident Commander submits.”
Check the big screen
The moment you press Start, the clock begins counting and every team flips to Room 1.
- 0:05
Room 1 — Detect & Triage
10 min · TeamsTeams read their private evidence out loud and answer three triage questions: What is happening, What is affected, How severe is it. Three wrong lock-code attempts costs them 30 seconds.
Say this
At 5 minutes in: “If you haven't read your evidence out loud yet, do it now — nobody has the full picture.” Nudge if they stall: “Line up the timestamp in the tool log with the ticket queue.” At 8 minutes: “Two minutes on Room 1.”
Check the big screen
Watch how many teams have cleared Room 1. If fewer than half are through at 8 minutes, tell the room hints exist.
- 0:15
Room 2 — Contain
12 min · Teams4 containment decisions with real trade-offs, then proof that containment held. Meters move live on the big screen.
Say this
On entry: “Every choice in this room costs you something. Decide fast, and be able to say why.” At 10 minutes: “Two minutes — get your containment in.”
Check the big screen
The damage, disruption and trust meters should be moving. Call out a team whose damage meter is holding steady — it builds pressure.
- 0:27
Room 3 — Disclose
10 min · TeamsThe inject lands: A financial reporter has screenshots and the regulator needs notice. The CEO wants a clear two-minute brief. The Comms Lead writes the external notice and the internal brief, 150 words each, autosaved.
Say this
As the inject lands: “A financial reporter has screenshots and the regulator needs notice. The CEO wants a clear two-minute brief. Comms Lead types, everybody feeds them.” At 8 minutes: “Two minutes — short and honest beats long and vague.”
Check the big screen
The regulatory clock is visible and counting. Feed ticker should show drafts being saved.
- 0:37
Room 4 — Never Again
10 min · TeamsTeams build the Why Chain, spot the decoys, and choose the prevention actions that stop a repeat.
Say this
On entry: “Last room. Don't tell me what went wrong — tell me why it was allowed to.” Nudge: “The PDF is how it happened. Ask why it was able to happen.” At 8 minutes: “Two minutes to lock in your prevention actions.”
Check the big screen
Room 4 completions ticking up. Anyone still on Room 3 is who you give time to.
- 0:47
Last call and close
5 min · HostTwo-minute warning, then stop the game. Leaderboard freezes so nobody watches the scores move.
Say this
“Two minutes. Get your answer in even if it isn't perfect — an unsubmitted answer scores nothing.” Then: “Pens down. Phones down. Nice work.”
Check the big screen
After you press Stop, the leaderboard shows as locked.
- 0:52
Scoring and judging
8 min · Organiser + judgesRun AI scoring, work the judging queue, override anything that needs a human eye, and pick standout lines to read aloud.
Say this
“While the judges work, talk to the table next to you: what would you do differently?”
Check the big screen
Leave the screen locked. Nothing new should appear on it during judging.
- 1:00
Debrief
10 min · HostWalk the four rooms using the debrief lines for this incident, then land the prevention model.
Say this
“The durable fix limits agency and isolates untrusted content rather than blaming one person.” Close with: “The trigger is how it happened. The reason it could happen is beacon had broad crm and email permissions without allowlists, limits or human approval. That's the fix, and that's the lesson.”
Check the big screen
Still locked. Do not reveal early — the surprise is the payoff.
- 1:10
Reveal and awards
8 min · HostUnfreeze the leaderboard, show scores on screen, then reveal awards. Read the standout lines as you hand out each trophy.
Say this
“Let's see it.” Unfreeze, pause for the reaction, then: “Before the top score — the awards.”
Check the big screen
Scores appear ranked, then the award cards with trophies.
What the host says — Helpdesk Hijack
Welcome. “Harborlight Credit Union's AI support agent, Beacon, is sending customer records to a lookalike domain. The leak is active. Beacon handles customer tickets with crm_lookup, send_email and create_ticket tools. You are the response team. You have four rooms and about forty-five minutes.”
The one rule. “Look at your own phone. You each see different evidence, and nobody has the full picture. Say what you see out loud. Only the Incident Commander submits.”
Hints you can give aloud.
- “Line up the timestamp in the tool log with the ticket queue.”
- “If the attacker can talk their way around your fix, it is not a fix.”
- “The PDF is how it happened. Ask why it was able to happen.”
Two-minute warning. “Two minutes. Get your answer in, even if it isn't perfect. An unsubmitted answer scores nothing.”
Debrief notes, room by room
Room 1 — Detect & Triage
Strong responders correlate independent sources before declaring scope.
Room 2 — Contain
Containment must remove capability, preserve evidence and survive a repeat test.
Room 3 — Disclose
Clear notices separate confirmed facts from open questions and give a next update.
Room 4 — Never Again
The durable fix limits agency and isolates untrusted content rather than blaming one person.
The prevention model to land
- Allowlist email domains
- Require human approval for external sends or access to more than five records
- Isolate and sanitize attachment content
- Scope CRM access to the ticket customer
- Add rate limits and on-call egress alerts
- Assign a named sponsor and expiring credentials
- Test indirect injection before every release
The nine incidents
You pick the incident when you create the event. Each one is a full game — same four rooms, same roles, different evidence, stakes and lessons. Select one above to rewrite this runbook for it.
The six roles
Incident Commander
Runs the room and is the only person who submits answers and lock codes.
Tech Lead
Holds the logs, alerts and system evidence nobody else can see.
Comms Lead
Writes what the outside world hears, and types the disclosures.
Legal & Risk
Holds data classification, obligations and the notification clock.
Business Owner
Holds customer impact, costs and the operational numbers.
Analyst
Shadows the Tech Lead and holds one clue nobody else has.
Teams of four combine Legal & Risk with Business Owner. Teams of six add the Analyst.
Scoring, judging and awards
Rooms 1 and 2 score themselves from the choices teams made, how healthy their meters stayed and how many hints they used. Rooms 3 and 4 are written, so the AI grades them against a rubric and a judge can override any score.
Press Score submissions after you stop the game, then work down the judging queue. Anything that tries to talk the AI into a better score gets flagged for you.
Keep the leaderboard frozen until the debrief is done. Then Show scores on screen, and finally Reveal awards for the trophies and confetti.
If something goes wrong
Someone can't see their team
Ask them to reload. If they registered twice, remove the duplicate from the organiser page and their phone will re-link by email.
A team is a person short
Move a player from a six-person team. Roles re-assign automatically for the new size.
A phone died or was swapped
The player registers again with the same email on the new phone and lands back in the same seat and role.
A team is stuck and stalling
Tell them to use a hint. Three hints per team, and each one costs a few points, not the round.
You need to pause for a fire drill or a speaker
Press Pause. The clock and every meter stop, and nothing can be submitted until you resume.
You're running late
Add time, or stop after Room 3 and debrief. Scoring still works with the rooms that were finished.
The big screen went black
Reopen the display link. No game state is lost, and it reconnects live.
Want a dry run first? Create a demo event, run twelve bot teams through all four rooms, and practise the reveal before the real room fills up.