Featured IMs Framework

This page documents the “Real-Life IMs” feature and provides guidelines for contributors.

What Are Real-Life IM Callouts?

Throughout the IM Handbook, you’ll find callout boxes where practicing Incident Masters share their personal facilitation techniques. These callouts:

• Offer concrete examples from actual sessions
• Present techniques as options, not requirements
• End with “Your choice:” alternatives for readers
• Use first-person voice (“I like to…”)

Per-IM Color Coding

Each IM has a unique color wrapper class (.im-joe, .im-[name], etc.) applied to BOTH their profile and technique callouts. This creates visual consistency so readers can easily identify which IM is sharing a technique.

Color Assignments

IM	Class	Color
Joe	.im-joe	Purple
Inver	.im-inver	Blue
(Future)	.im-[name]	Teal
(Future)	.im-[name]	Emerald
(Future)	.im-[name]	Amber
(Future)	.im-[name]	Red

Current Featured IMs

Joe

Background:

• First-ever Malware & Monsters Incident Master (DefCon 2025)
• 25+ years CISO experience across defense, finance, and legal industries
• Professional tabletop game master with extensive online session experience

Facilitation Style:

• Performance-oriented dice delivery with suspense and humor
• Fully voiced NPCs with distinct personalities
• Strong emphasis on player agency (“What are you doing?”)
• Adaptive pacing based on story completion rather than strict time limits

Featured Techniques:

• Post-roll interpretation delays for suspense building
• “Cursed dice” humor for making failures entertaining
• Named NPCs with conflicting motivations
• Decision-based session endings

Inver

Background:

• Privacy lawyer and professional TTRPG designer/publisher
• Career spanning the US Coast Guard, privacy consulting, and compliance auditing
• Runs “Cult of Privacy” initiative, presenting at conventions and conferences
• Deep expertise in GDPR, CCPA, and real-world data protection incident patterns

Facilitation Style:

• Detail-oriented preparation with production-quality handouts and props
• Privacy-focused scenario design weaving compliance obligations into cybersecurity incidents
• Spotlight mechanics to showcase each player’s role
• Custom Malmons grounded in real attack patterns encountered professionally

Featured Techniques:

• Pending first session — technique callouts will be added after observing Inver facilitate her first M&M game

Callout Formats

Profile Callout Format (Chapter 00)

Wrap a standard callout with the IM’s color class:

::: {.im-joe}
::: {.callout-note title="🎭 Joe"}
**Background:** [Experience and credentials - 1-2 sentences]

**Style:** [Their approach in 2-3 sentences]

**Philosophy:** [Personal approach note - acknowledge different styles are valid]

**Look for:** "From Joe:" callouts (in purple) throughout this handbook...
:::
:::

Technique Callout Format (Throughout Handbook)

Wrap technique callouts with the same IM color class:

::: {.im-joe}
::: {.callout-tip title="From Joe: [Technique Name]"}
[First-person description of the technique - what you do and why]

[Specific example from an actual session]

**Your choice:** [Alternative approaches for readers who prefer different styles]
:::
:::

Format Requirements

1. Wrapper: Always use the IM’s color wrapper class around the callout
2. Title: Always “From [First Name]: [Technique Name]”
3. Voice: First-person, conversational (“I like to…”, “In my sessions…”)
4. Example: Include at least one concrete example from an actual session
5. Your choice: Always end with alternatives that respect different styles
6. Length: 150-250 words (focused and scannable)

What NOT to Include

• Full names (first name only for privacy)
• Photos or headshots
• Prescriptive language (“You should…”, “Always do…”)
• Criticism of other facilitation styles
• Techniques that only work in very specific contexts

Adding a New Featured IM

Requirements

To be featured, an IM should have:

• Facilitated at least 3 Malware & Monsters sessions
• A distinct facilitation style worth showcasing
• Willingness to share techniques in first-person voice
• Approved all attributions and content

Process

1. Propose: Open a GitHub issue describing the IM and their notable techniques
2. Assign Color: Choose next available color from the palette
3. Add SCSS: Add .im-[name] styles to _scss/_unified-integration.scss
4. Draft Profile: Create profile callout in Chapter 00 with .im-[name] wrapper
5. Draft Techniques: Write 3-5 technique callouts with .im-[name] wrapper
6. Review: Get approval from the proposed IM for all attributions
7. Integrate: Add callouts to relevant handbook chapters
8. Document: Update this page with the new IM’s profile

SCSS Template for New IMs

Add to _scss/_unified-integration.scss:

// [Name] - [Color] (Brief description)
.im-[name] .callout {
  border-left-color: [light-color] !important;
  background: linear-gradient(135deg, rgba([r], [g], [b], 0.08) 0%, rgba([r], [g], [b], 0.03) 100%) !important;

  .callout-title-container { color: [light-color] !important; font-weight: 700; }
  .callout-icon { color: [light-color] !important; }
}

// Dark mode
[data-bs-theme="dark"] .im-[name] .callout,
.quarto-dark .im-[name] .callout {
  border-left-color: [dark-color] !important;
  background: linear-gradient(135deg, rgba([r], [g], [b], 0.15) 0%, rgba([r], [g], [b], 0.05) 100%) !important;
  .callout-title-container { color: [dark-color] !important; }
  .callout-icon { color: [dark-color] !important; }
}

Placement Guidelines

Insert callouts where they complement existing handbook content:

• After the relevant universal principle is explained
• Within sections discussing the specific technique
• Not replacing handbook guidance—supplementing it
• Limit 1-2 callouts per major section (avoid overwhelming readers)

Philosophy

The Real-Life IMs feature exists to show that there’s no single “right way” to facilitate. By showcasing multiple experienced IMs with different styles, we:

• Validate diverse facilitation approaches
• Provide concrete examples beyond abstract principles
• Help new IMs find techniques that match their personality
• Build community connections between facilitators

Every callout should reinforce this philosophy: Your way is valid. Here’s one approach that works for someone—adapt it, ignore it, or try something completely different.