Opening Script for New IMs
Pre-Session Setup (5 minutes before start)
Materials Check
Mental Preparation
- Review chosen Malmon card
- Check organization context and symptoms
- Take deep breath - you’ve got this!
Opening Welcome
The Confident Opening
“Welcome everyone! I’m [Your Name] and for the next 90 minutes, you’re going to become an incident response team facing a real cybersecurity crisis.”
“This isn’t a lecture where I tell you what to think. You’ll be the experts solving problems together, and I’m here to facilitate your discovery.”
Setting Expectations
“Here’s what to expect: You’ll investigate a threat, figure out what you’re dealing with, and coordinate a response. The content comes from your expertise - I’ll ask questions and help guide the process.”
“Questions are always welcome, and there are no wrong answers - only learning opportunities.”
Expertise Discovery
The Expertise Round Script
“Before we dive into the emergency, let’s see what expertise we’re working with. Let’s go around quickly:”
“Share your first name and one thing you know about computers or cybersecurity. This could be work experience, personal projects, something you’ve read about, or just common sense.”
Facilitation During Introductions
Encourage Breadth
“Technical and non-technical insights are both valuable here.”
Time Management
“About 30-45 seconds each - we want to hear from everyone.”
Response Examples
- Technical background: “Great - you’ll bring hands-on perspective.”
- Business background: “Perfect - understanding impact is crucial.”
- Limited background: “Curiosity and fresh thinking are incredibly valuable.”
- Student/learning: “Learning mindset is exactly what we need.”
Taking Mental Notes
Track for role assignment:
- Who has technical troubleshooting experience? (Detective/Protector)
- Who understands networks or data? (Tracker)
- Who works with people or business? (Communicator)
- Who manages projects or coordinates? (Crisis Manager)
- Who asks good questions or notices patterns? (Threat Hunter)
Role Assignment
Assignment Script
“Based on what you’ve shared, I’ll suggest roles for our incident response team. Feel free to speak up if you’d prefer something different:”
Role Assignment Examples
For IT Support/Help Desk Background
“[Name], your IT support background makes you perfect for our Detective role - you’re used to finding clues when things go wrong.”
For Development/Technical Background
“[Name], with your development experience, you’d be great as our Protector - you understand how systems work and how to secure them.”
For Network/Infrastructure Background
“[Name], your network experience is perfect for our Tracker role - you’ll monitor data flows and spot unusual patterns.”
For Business/Management Background
“[Name], your business background makes you ideal as our Communicator - you understand stakeholder needs and organizational impact.”
For Project Management/Leadership
“[Name], your coordination experience is perfect for Crisis Manager - you’ll help orchestrate our overall response.”
For Analytical/Security Background
“[Name], your analytical thinking makes you perfect as our Threat Hunter - you’ll look for what others might miss.”
Role Discovery Through Questions
Instead of explaining roles, let players discover what they do:
“What do you think someone in [assigned role] would focus on during a cybersecurity crisis?”
Build on their responses:
- 🔍 Detective: “Yes! What kinds of clues would you look for?”
- 🛡️ Protector: “Exactly! How would you protect the organization?”
- 📡 Tracker: “Right! What would you monitor or track?”
- 👥 Communicator: “Perfect! Who would you need to coordinate with?”
- ⚡ Crisis Manager: “Absolutely! How would you organize the response?”
- 🎯 Threat Hunter: “Great thinking! What would you hunt for?”
Confirmation
“How do these assignments feel? Any adjustments needed?”
Character Development
Character Creation Instructions
“Now let’s develop your character. Keep your real name but build your professional persona around your assigned role.”
“Think about these questions for 2-3 minutes:”
- “What’s your work obsession or quirk?”
- “Why do you personally care about protecting this organization?”
- “What would devastate you if it were compromised?”
Encouragement During Development
“Have fun with the stereotypes - they exist because they’re rooted in truth!” “If you’re the Detective, maybe you’re obsessed with details others miss.” “If you’re the Protector, maybe you take attacks personally.” “Lean into what makes your role distinctive.”
Support for Struggling Participants
Move around the room, available for quiet consultation:
- “Just think about why someone in your role would care about cybersecurity.”
- “What would worry you most if you had this job?”
- “You can use your real background as your character background.”
In-Character Introductions
Scene Setting
“The emergency alarm just went off at [Organization Name]. You’re all rushing to the situation room for an urgent incident response meeting.”
“Introduce yourselves as your characters - you’re meeting for the first time under pressure. About 30 seconds each.”
Example Character Introductions
Detective Example
“I’m Sarah from IT Support. I’ve been watching our system logs like Netflix for three years, and something’s been bothering me since yesterday - patterns are 15% off normal, and I can feel it.”
Protector Example
“Marcus here, Systems Administration. These servers are my babies, and someone’s been messing with them. I’ve got defensive tools ready to deploy, and I’m taking this personally.”
Tracker Example
“I’m Alex from Network Operations. I see our network like a subway map in my head, and there’s definitely a train going somewhere it shouldn’t. Calling it ‘Sketchy Pete’ until we know what it really is.”
Your Response to Characters
Build energy and acknowledge each character:
- “I love that protective instinct, Marcus.”
- “Sarah, your pattern recognition is exactly what we need right now.”
- “Alex, that visualization skill will be crucial.”
Crisis Presentation
Organization Context
“Quick context - what kind of organization are we protecting today?”
Let group decide or provide context: - “Mid-sized healthcare technology company with patient data” - “Regional bank with customer financial information” - “Manufacturing company with production control systems”
Crisis Discovery with Evidence
“We’re getting reports from users. What kinds of symptoms would worry you if users started calling about them?”
After they suggest possibilities, present initial evidence:
“Let me show you what we’re seeing…”
Initial Evidence
“This is the kind of evidence that starts landing on your desk. What patterns do you see here that would concern you?”
After discussion, continue: “Based on these symptoms, what are your initial thoughts about what might be happening?”
Stakes and Urgency
“[Critical organizational asset] is at risk. [Specific consequences if not resolved]. The clock is ticking.”
Discovery-Driven Setup
“Before we dive in, what do you think an incident response team needs to accomplish during a crisis like this?”
Guide toward key concepts through their responses:
- “Yes, we need to figure out what’s happening!”
- “Absolutely, understanding the impact is crucial!”
- “Right, we’ll need to coordinate our response!”
“So we’ll work through this systematically - discovery, investigation, and response. You’ll each contribute from your expertise area.”
Transition to Round 1
Launch into Discovery
“Round 1 starts now. Each role investigates from their expertise area. Detective Sarah, your instincts are telling you something’s wrong - what’s your first move?”
Emergency Phrases for Nervous Moments
When You Lose Your Place
“Let me check my notes for a second… [brief pause] Okay, where were we?”
When You Make a Mistake
“Actually, let me correct that… [fix error] Thanks for bearing with me.”
When You Don’t Know Something
“That’s a great question. Who here might have experience with that?”
When Timing Gets Off
“We’re doing great - let me just adjust our timing slightly.”
When Energy Drops
“I can see this is a lot to process. Let’s refocus on what’s most urgent.”
Confidence Reminders
Before Session Starts
- You don’t need to know everything - players provide the expertise
- Questions are more powerful than answers
- Mistakes become learning opportunities
- Everyone wants this to be successful
- Your job is facilitation, not technical instruction
During Session
- Trust the process - it works
- Follow player interest and energy
- When in doubt, ask a question
- Build on what players contribute
- Keep focus on collaborative discovery
Remember
The players WANT to learn and engage. Your role is to create the space for that to happen, not to be the source of all knowledge.