PATCHWORK ACADEMY // INCIDENT RESPONSE SIMULATION

INCIDENT RESPONDER

NIST IR FRAMEWORK — INTERACTIVE TRAINING

▶ INCOMING TRANSMISSION — COMMANDER SHEPARD

"Listen up. A threat actor is currently inside your network. I don't know how long they've been there. I don't know what they've taken.

What I know: you're the first responder. Four phases stand between you and a closed incident — Detect, Contain, Eradicate, Recover.

Every choice you make is logged. Every roll of the die has consequences. There's no rewind.

This is not a simulation."

🎲 HOW THE DICE WORK

At key moments, the game asks you to roll a 20-sided die — basically a random number between 1 and 20. You'll see a DC (Difficulty Class) — that's the minimum number you need to roll to succeed.

Roll ≥ DC → SUCCESS

e.g. DC is 12, you roll a 15 — you succeed.

Roll < DC → FAIL

e.g. DC is 12, you roll an 8 — things get harder.

Your choices change the DC. Pick the smart move and the DC drops — better odds. Rush in blind and the DC goes up. Failure doesn't end the game, it just makes the next phase harder.

4 PHASES

DETECT → CONTAIN → ERADICATE → RECOVER

D20 ROLL

1–20 random, beat the DC to win

DUAL TRACK

XP + Stress carry through

← BACK TO MISSIONS