PATCHWORK ACADEMY // INCIDENT RESPONSE SIMULATION

INCIDENT RESPONDER

INSPIRED BY NIST IR GUIDANCE — INTERACTIVE TRAINING

▶ INCOMING TRANSMISSION — COMMANDER SHEPARD

"Listen up. A threat actor is currently inside your network. I don't know how long they've been there. I don't know what they've taken.

What I know: you're the first responder. Four phases stand between you and a closed incident: Detect, Contain, Eradicate, Recover.

Every choice you make is logged. Every roll of the die has consequences. There's no rewind.

This is not a simulation."

🎲 HOW THE DICE WORK

At key moments, the game asks you to roll a 20-sided die, basically a random number between 1 and 20. You'll see a DC (Difficulty Class). That's the minimum number you need to roll to succeed.

Roll ≥ DC → SUCCESS

e.g. DC is 12, you roll a 15, and you succeed.

Roll < DC → FAIL

e.g. DC is 12, you roll an 8, and things get harder.

Your choices change the DC. Pick the smart move and the DC drops, meaning better odds. Rush in blind and the DC goes up. Failure doesn't end the game, it just makes the next phase harder.

4 PHASES

DETECT → CONTAIN → ERADICATE → RECOVER

D20 ROLL

1–20 random, beat the DC to win

DUAL TRACK

XP + Stress carry through

← BACK TO MISSIONS