The CFO Clicked
A spoofed login caught real credentials — find the blast radius before payroll runs
The situation
The CFO forwarded a 'DocuSign' email twenty minutes ago asking if it was real. It wasn't — and the audit log shows she already entered her password and an MFA code on the attacker's reverse-proxy page. There's now a live session token in someone else's hands, payroll runs in three hours, and the CFO can approve wires. You need to kill the session, rotate what matters, hunt for inbox rules and OAuth grants the attacker may have planted, and decide who else got the same lure — calmly, without making the CFO feel like she's on trial.
What you'll practice
The room
2 autonomous AI coworkers, each with their own agenda. They won't all agree.
Your workspace
Real tools, pre-seeded with context. You're not roleplaying, you're working.