Cybersecurity Boardroom Simulator | Abdullah Bin Zarshaid

Fictional quarter A / 12 BUDGET UNITS

Customer assurance under an access-control deadline

A fictional software provider has one quarter to answer a strategic customer’s access-control questions. The current policy is documented, but operating evidence is fragmented.

Board question

Which package should the steering group fund before making a stronger assurance statement?

1. Choose a funding package

Each rating is part of this fictional teaching model, not a forecast or professional recommendation.

ABuild the evidence baseline11 budget units · Prioritizes a scoped access population, review records, exceptions and accountable ownership before stronger claims are made.BRun a control-hardening sprint12 budget units · Funds selected technical changes quickly, with less capacity left to establish whether the changes operated across the full review population.CPackage the existing narrative8 budget units · Produces a fast customer response from existing policy material.

2. Mark the evidence actually available

Leave an item clear when it is unknown, incomplete or outside the review period.

Defined system, identity population and review period25% of the evidence-sufficiency viewCompleted access-review records from the stated population30% of the evidence-sufficiency viewExceptions, overdue items and treatment decisions20% of the evidence-sufficiency viewNamed accountable owner and reviewer15% of the evidence-sufficiency viewCollection date and evidence-freshness boundary10% of the evidence-sufficiency view

Fictional quarter B / 14 BUDGET UNITS

Ransomware recovery before the peak operating season

A fictional manufacturer has backups, endpoint tooling and a response plan. Leadership cannot yet show that a priority service can be restored within the stated objective.

Board question

How should the quarter’s limited capacity be used before leadership reports recovery readiness?

1. Choose a funding package

Each rating is part of this fictional teaching model, not a forecast or professional recommendation.

AProve one critical restore path14 budget units · Combines scoped dependency mapping, a controlled restoration exercise and documented follow-up for one priority service.BAccelerate the endpoint refresh15 budget units · Improves a preventive and detection layer, but exceeds the quarter’s teaching budget and does not test restoration.CRun a leadership tabletop only7 budget units · Clarifies decision rights, communications and escalation at relatively low cost.

2. Mark the evidence actually available

Leave an item clear when it is unknown, incomplete or outside the review period.

Priority service, dependencies and recovery boundary20% of the evidence-sufficiency viewBackup configuration and protection state for that boundary20% of the evidence-sufficiency viewObserved restore exercise with retained results30% of the evidence-sufficiency viewMeasured result against stated recovery objectives20% of the evidence-sufficiency viewUnresolved failures, owners and next-test date10% of the evidence-sufficiency view

Fictional quarter C / 10 BUDGET UNITS

A customer-support AI pilot with sensitive context

A fictional product team wants to pilot an assistant that can retrieve internal support material. Data boundaries, tool permissions and output handling are only partly defined.

Board question

What should be funded before the pilot moves from a sandbox to a bounded internal trial?

1. Choose a funding package

Each rating is part of this fictional teaching model, not a forecast or professional recommendation.

AFund a narrow, evidence-gated trial10 budget units · Constrains data and tools, records test cases and owners, and requires explicit exit criteria before broader use.BLaunch broadly and add monitoring later8 budget units · Moves quickly with more use cases available from the start.CPause for a use-case and data inventory6 budget units · Clarifies intended users, data and decision boundaries before technical testing begins.

2. Mark the evidence actually available

Leave an item clear when it is unknown, incomplete or outside the review period.

Approved use cases, users and prohibited uses25% of the evidence-sufficiency viewData sources, retrieval boundary and tool permissions25% of the evidence-sufficiency viewRecorded prompt, retrieval and output-handling tests20% of the evidence-sufficiency viewLogging, review and escalation path15% of the evidence-sufficiency viewOwner, stop conditions and rollback route15% of the evidence-sufficiency view

A budget is a decision.
Evidence makes it defensible.

Customer assurance under an access-control deadline

Unresolved evidence

Explicit trade-off

Ransomware recovery before the peak operating season

Unresolved evidence

Explicit trade-off

A customer-support AI pilot with sensitive context

Unresolved evidence

Explicit trade-off

The score is the start of the conversation.

What are you looking for?

Confirm action

A budget is a decision.Evidence makes it defensible.

Unresolved evidence

Explicit trade-off

Unresolved evidence

Explicit trade-off

Unresolved evidence

Explicit trade-off

The score is the start of the conversation.

A budget is a decision.
Evidence makes it defensible.