A Tabletop Tuesday scenario: cloned voice, urgent wire, 40-minute head start
Every week we publish one incident response scenario built for leadership teams, not SOC analysts. Read it aloud in your next leadership meeting, work the three decisions, and find your gaps on a Tuesday instead of during the real thing.
Read this aloud to your leadership team. Two minutes.
Friday, 4:47 pm. Your controller's phone rings. Caller ID shows the CEO's cell. The voice is the CEO's: the cadence, the impatience, even the joke about legal. "We are closing the acquisition tonight. I need $486,000 to the escrow account in the next hour or the timing falls apart. Keep it quiet until Monday, I don't want the team distracted."
The controller has wired money on the CEO's verbal say-so before. At 5:12 pm the wire goes out. At 5:50 pm the real CEO calls about something unrelated, and the controller's stomach drops. The voice was cloned from twenty minutes of podcast and earnings-call audio. The account was opened three weeks ago. The money has a 38-minute head start, and it is Friday evening.
"It was his voice. I would have sworn it was him."
Four minutes each. The goal is an owner and a gap, not a perfect answer.
The recall window for a domestic wire is measured in hours, and it is already 5:50 pm on a Friday. Bank recall desk, FBI, insurer's fraud line: what is the order, who has the numbers, and who owns making those calls right now? If the answer is "the controller who just got burned," that is a gap.
They followed what they believed was a direct order from the CEO, and they self-reported within the hour. Treat them as a suspect and the next employee sits on the next incident for a week. What does your response, in the room and in writing, say about what happens to people who report fast?
"Call back on a known number" dies the moment an executive says the word urgent. What out-of-band verification for money movement will your executives actually tolerate, at what dollar threshold, and who is exempt? The correct number of exempt people is zero, including the CEO asking for the exemption.
Fifteen minutes in any leadership meeting. No slides, no gotchas.
| Minutes | What Happens | Capture |
|---|---|---|
| 0–2 | Read the scenario aloud, verbatim. No preamble. | Nothing yet. Let it land. |
| 2–14 | Work the three decisions, four minutes each. The facilitator's only job is to ask "who owns that?" and "is that written down?" | One owner and one gap per decision |
| 14–15 | Assign the gaps. Each one gets a name and a date. | Three actions, three owners, three dates |
What good looks like: recall calls started within the hour from a list that already existed, one person clearly in command, a controller treated as the first reporter rather than the first suspect, and a verification rule that survives contact with an impatient CEO.
This is the lightweight version. Our facilitated executive tabletops pressure-test decision rights, communications, and escalation paths against scenarios built for your business, and end with a funded roadmap instead of a shrug.
