Corporate Dungeon Master: How to Lead Cyber Games at Work

This talk presents the cyber action officer role, a job many companies have only recently created, as similar to a Dungeon Master's. The speaker, who moved from threat intelligence and government contracting into this position at a financial institution, explains that much of the work is running tabletop exercises rather than managing live crises. He gives a short primer on Dungeons and Dragons for attendees who have not played, covering character creation, dice, and the game master's job of narrating the story and controlling non-player characters.

The middle of the talk maps the game onto exercise design. Preparation resembles a session zero: citing existing policies and architecture documents, drawing realistic threats from past incidents and public breach reports, and building a stakeholder group around a senior executive sponsor who owns the exercise and steers discussion. The scenario is laid out in a master scenario events list of injects, with a short overview written early. During delivery, the facilitator keeps the scenario close to real processes, stays ready to improvise when participants push the plot somewhere unexpected, manages the clock, and records sessions to support note-taking.

The talk closes with aftercare. After an exercise, the facilitator collects feedback, writes an after-action report, and holds a review meeting where gaps become process improvement opportunities, each with a named owner. The speaker notes that roughly 90-minute sessions work well and that the same approach suits cross-functional collaboration exercises. The takeaway for practitioners is a structure for planning, running, and following up on exercises that involve senior leaders.