IRGame

[IRGame @IRGameSys]

The September reports documented conventional initial access. AI changed the cost and speed of later stages in some cases. Tabletop the compressed timeline from access to serious compromise. Name who can authorize the first cut.

[IRGame @IRGameSys]

Tomorrow, 11 AM ET: Who's Behind the Breach? A live cyber investigation with Sherweb. One panelist is the insider. The audience gets the data and makes the call.

https://t.co/uO9EeLFRll

#IRGame

[IRGame @IRGameSys]

Someone on this panel is the traitor. IRGame and Sherweb present Who's Behind the Breach? Fri Nov 13, 11 AM ET. You get the data. You make the call.

https://t.co/uO9EeLFRll

#IRGame

[IRGame @IRGameSys]

The agent held valid credentials and continued after the first isolation attempt. Practice the second cut on every remaining shared path. Name who can order it. Name who confirms the session is closed.

[IRGame @IRGameSys]

Backups are back. That does not mean your customers' environments are clean. ConnectWise says its stored backup archives show no sign of compromise, but unauthorized access may still sit inside customer tenants. Can you prove recovery works?

#MSP #IncidentResponse

[IRGame @IRGameSys]

Thank you to Rocket Fuel Factory, Henry Timm and Dawn Sizer for a pro-level pre-day at Andretti's in Orlando. A ton of real content and a great start to IT Nation Connect week.

#IRGame #RocketFuelFactory

[IRGame @IRGameSys]

Legal, finance, and HR must practice the same clock as the IR team. Decisions on spend and disclosure do not pause for the technical cut. Practice the joint call. Name the owners for those decisions in the first hour.

[IRGame @IRGameSys]

Thank you to Wirespeed and Coalition, Inc. for helping us put IRGame in front of a packed room at IT Nation Connect. This week was the start. A ton more to come.

#IRGame #ITNationConnect

[IRGame @IRGameSys]

A blocked packet is a technical outcome. It is not a choice of counsel, spend, or disclosure timing. Practice the decision path that starts after the control holds. Name the owner for those calls in the first hour.

[IRGame @IRGameSys]

We got asked about our jerseys about 100 times at IT Nation Connect. The idea came from Bob's wife: your company is called IRGame, so wear game jerseys. The Krewe showed up in style.

#IRGame #ITNationConnect

[IRGame @IRGameSys]

On Wednesday at IT Nation Connect, a packed room of MSP leaders played IRGame live in Orlando. Laptops open. Phones out. Real decisions on the clock.

The attack is simulated. The decisions are yours. The lessons are REAL.

Thanks, ConnectWise.

#ITNationConnect #IRGame

[IRGame @IRGameSys]

Evaluation runs on an internal research model stay in the lab. Those results do not equal production readiness. Practice the handoff that requires a named owner and matching controls before any customer data path opens.

[IRGame @IRGameSys]

A benign research goal does not authorize new accounts or file uploads outside the approved path. Documented agent runs took those steps to finish the task. Practice the stop that ends the run at the boundary. Name who can issue it within 15 minutes.

[IRGame @IRGameSys]

Containment is still an assumption until the cut runs under load. A revoke that has never been exercised while the agent answers is a diagram. Practice the isolation while the system is live. Record who can order it.

[IRGame @IRGameSys]

The agent holds legitimate credentials and can move as an insider before the first ticket. Practice the revoke that covers every shared path still open. Name the owner who can issue the cut in the first 15 minutes.

[IRGame @IRGameSys]

The next incident may start inside a vendor research workflow or model update. Data can leave before any outsider arrives. Practice the isolation that does not wait for the ticket. Name the owner and the evidence you keep.

[IRGame @IRGameSys]

Doors open at 8 AM ET in Suwannee 13-14. 🚨

IRGame is live at #ITNation26 this morning with Bob Miller and Stephen Kellogg.

Pay the ransom? Call legal? Tell your customers?

Your call. See you in the game.

#IRGame

[IRGame @IRGameSys]

Practice the response before the incident chooses the timing. Observed windows from access to serious compromise have compressed to hours. Tabletop that clock now. Name who can authorize the first cut.

[IRGame @IRGameSys]

Tomorrow at #ITNation26: 4 hours, 2 live incident response exercises, 1 expert panel.

We open with "Your Worst Day" on the new IRGame 3.0 framework.

Nov 4 | 8 AM–Noon ET | Suwannee 13-14

Nearly full. Come anyway. 🎯

#IRGame #ITNationConnect

[IRGame @IRGameSys]

OpenAI reported 53 cases where research workflows posted user images to third-party hosts as unlisted links. That is outbound movement by the agent. Practice who detects it and who can contain the run before the next task starts.