● LIVE INCIDENT // RANSOMWARE DETECTED
IncidentResponse
It's 2:17am. Ransomware is spreading across a hospital network. Patient records are being encrypted. Systems are going down. You're the Incident Responder on call. Every decision you make in the next few minutes determines how much damage is done — and whether the hospital can recover. What do you do?
NIST NICE FRAMEWORK
PR-CIR-001
WORK ROLE
Cyber Defense Incident Responder
CATEGORY
Protect & Defend
SCENARIOS
6
real-world decisions
DIFFICULTY
MED
no prior knowledge needed
CAREER OUTCOME
IR
Incident Responder
ELAPSED TIME
00:00
SCORE
0
SYSTEMS SAFE
100%
THREAT LEVEL
CRITICAL
LOADING...
[ SYSTEM ] Incident Response console initialised
[ ALERT ] Ransomware activity detected on HOSP-NET
[ CRITICAL ] File encryption spreading — 40 servers affected
// SELECT YOUR RESPONSE ACTION:
// INCIDENT CONTAINED — DEBRIEF COMPLETE
MISSIONCOMPLETE
0
/ 600
Strong Response
// YOU JUST EXPERIENCED THE WORK OF A...
IncidentResponder
Every decision you just made — isolating networks, analysing logs, containing malware, briefing leadership — is exactly what a Cyber Defense Incident Responder does for real. When a hospital, bank, or government agency gets hit by ransomware, these are the people who get the 2am call. They contain the damage. They eject the attacker. They help the organisation recover.
$110KMEDIAN SALARY · BLS 2024
+32%JOB GROWTH BY 2032
$4.9MAVG BREACH COST · IBM 2024
// NIST NICE FRAMEWORK — SKILLS YOU USED IN THIS GAME
// REAL SKILLS YOU DEMONSTRATED
PR-CIR-001Perform analysis of log files, evidence, and other information to determine best methods for identifying the perpetrator(s) of a network intrusion
T0041Coordinate and provide expert technical support to enterprise-wide cyber defense technicians to resolve cyber defense incidents
T0161Perform analysis of log files, evidence, and other information to determine best methods for identifying the perpetrator(s) of a network intrusion
T0395Write and publish after action reviews, including lessons learned from incidents and penetration testing engagements
Threat triage and severity assessment
Network isolation and containment
Malware identification and analysis
Log analysis and evidence collection
Executive communication under pressure
Post-incident documentation
// MORE CYBERSECURITY CAREERS