A facilitated crisis simulation for the people who own the outcome. While technical teams fight the intrusion, you will decide what to disclose, when, to whom — and how to keep essential services running for the public and your customers.
No technical background required. Written and delivered in the language of governance, legal obligation, and public trust.
0x0100 // Who should attend
City Managers
Accountable for resident-facing services and council communication.
Agency Directors
Responsible for program delivery and statewide public trust.
CISOs
Translating technical risk into executive decisions.
CIOs
Balancing restoration speed against operational risk.
General Counsel
Owning notification obligations and legal exposure.
0x0200 // Syllabus
PILLAR 01
Once a breach is suspected, deadlines start running. Practice deciding when an event becomes a notifiable incident.
PILLAR 02
The story moves faster than the forensics. Learn to say enough — accurately — without saying too much.
PILLAR 03
Every containment action has a cost to the public. Weigh it deliberately.
0x0300 // Tabletop integration
Traditional tabletops run on a fixed script. In 0xSAC, the scenarios you receive — called injects — are triggered by what is actually happening on the Track 1 range.
If a technical team contains the intruder quickly, your decisions get easier. If they lose a critical system, your service-outage briefing arrives minutes later. Your choices, in turn, are relayed back to the technical teams as leadership direction.
01 // Range event
A technical team detects data leaving a records server.
02 // Facilitator relay
The exercise control team converts the telemetry into a plain-language briefing.
03 // Executive inject
"Records for residents may be affected. Does the notification clock start now? Who approves the statement?"
04 // Decision returned
Your direction — isolate, restore, or hold — shapes what the technical teams do next.