←
Mission 1/5
XP 0
Evidence
A five-mission story game · you play with your own numbers

Fifty-four days blind.
Nine days slow.

A board asks Maya Reyes why nobody saw an intruder for two months, and she cannot answer — her dashboards are green and her SLA is fifteen minutes. You're going to answer it properly about your own incident, in the order that survives a board meeting. The first question is not how long it took. It's how you found out at all.

◔ Discovery Path ◧ Napkin ◫ The Split ◈ Two-Minute Check ◆ Queue Hunter ▣ Missing Station ✦ Log Verified ★ Board Believer
Mission 1

How did you find out?

The forensics report ran eighty-one pages. The board cared about one number: sixty-three days from the first stolen credential to the morning an analyst escalated it.

“I’m not asking how he got in. Doors get opened; that’s the world. I’m asking why nobody saw him for two months. I don’t want to know what you need — I want to know what you know. Where did the sixty-three days go?” — Hendricks, audit committee chair

She didn’t know. Nobody did: the dashboards were green and the team hit a fifteen-minute SLA on critical alerts. So she did the one thing nobody had done — she asked when the alert fired. Not when the incident channel opened. When the platform first raised its hand.

Day fifty-four.

Your turn — and this question comes first for a reason. If a stranger told you about your last incident, your detection queues explain none of the delay, and any chart you show about them is theatre. So: how did you actually find out?

Be honest here. It changes which half of the rest of this game even applies to you.
From the forensic timeline if you have one. This is the number your board remembers.
Optional. Hendricks’ real question is the second half of the elevator ask: does that cycle time work for your business?
Routes you to the right toolkit in mission 5.
Mission 2

The bleachers

Third row of the aluminium bleachers. Walt Otani — thirty years running plant operations before he retired into coaching third base — climbs up with two coffees.

“How many things does your team have open right now? How many finish in a week?” He does the division out loud. “That’s how long the average one lives in your shop. Same math as a parking lot.” — Walt, between innings

Then the part that mattered: “Now the fifty-four. What was happening in those fifty-four days?” Nothing, Maya said. Nobody was looking. “So where did they go?”

They didn’t go anywhere. There was nothing to time.

“Either the inspection station was backed up — a pile with a name on it I can measure with a stopwatch. Or there was no station on that line, and the part sailed through because nobody was looking for that defect. You can’t stopwatch what never started. You find it by subtraction.”
Mission tool · Ground level · 60 seconds

PFV on a Napkin

Walt’s division, live. This gives you the cycle time of your alert pipeline — the part of your world that does have queues.

  1. Open the napkin (new tab — this game keeps your place)
  2. Steps 2 and 3: alerts/cases open now, and how many close per week
  3. Read the red-pencil line: weeks each
Open the napkin ↗ then bring the number back
Everything opened and not closed — the whole standing pile.
Actually resolved, on an ordinary week.
Where did these two numbers come from?
Enter both counts (and say where they came from).
Mission 3

Split the number: blind vs slow

Priya pulled every status transition for the nine days after the alert fired. Seven of them were the alert sitting in a triage backlog no individual owned — the queue had a size limit and never an age limit. Total human attention across the nine days: six hours and forty minutes.

Then the subtraction. Sixty-three, minus the nine she could account for, left fifty-four days that were not a queue at all — nothing was looking for the technique he used to get in. When she raised it, the detection lead said “we have nine hundred rules.” None matched that technique. Rule count is inventory, not coverage.

Mission tool · Level 1 · 2 minutes

PFV-EZ — the 2-minute exposure check

Map your detection-to-containment chain: alert fires → picked up → triage → escalation → investigation → contained. EZ gives you lead time, PCE, and which single wait is biggest.

  1. One row per stage, with hands-on hours and waiting days
  2. Mark any stage that sends work back with its ↻ back to control
  3. Set your target lead time under Advanced — your own commitment beats a generic band
  4. Set the Observed / Hypothesized / Verified strip to match what you enter below
  5. Press See my exposure; keep the .xlsx if you want the map
Run the 2-minute check ↗
The measurable half: everything from the moment your platform raised its hand to the moment you contained it. Add up the stage elapsed times.
Honest keyboard time only — triage, investigation, confirmation. Not elapsed time.
One stage's waiting — the tallest pile, not the total.
This decides which fixes can actually touch it.
Where did the flow numbers come from?
Closed then reopened, kicked back for missing detail, re-triaged. Zero is legitimate — but check before you type it. This is the only number here that can change how many cases you finish per year.
Fill in the accountable days, hands-on hours, the biggest wait, and where the numbers came from.
Mission 4

Two problems, two owners

Maya’s remediation lead pushed back first: “We’re maxed. Everyone is at a hundred and ten percent.” He was right about the effort and wrong about where the time lived. Her detection lead pushed back second, with rule count.

“Everybody wants to argue about the pile, because a pile you can point at. Nobody wants to say out loud that on some lines there’s no station.”

Five proposals. Each one touches the blind half, the slow half, or neither. Choose, then see all five measured against your numbers.

Mission 5

The room where you get believed — or don't

January. Same table, same chair, same man. Maya put up one slide: a photograph of a napkin. Two numbers, two asks, and one of them labelled a projection rather than a result.

Mission tool · Full depth · build the case

Process Flow Worksheet & Investment & Return Calculator

A board asks two follow-ups: what will it cost and how sure are you. The worksheet holds the chain stage by stage with rework loops; the calculator turns your fix into payback, ROI, and confidence bands — and keeps the projection labelled as a projection.

  1. Rebuild your detection chain in the worksheet
  2. Model your chosen fix as the future state
  3. Run the Investment & Return Calculator for the business case
Open the worksheet ↗ Open the calculator ↗