Rolling for Resilience Part 2: The Communication Gauntlet

This is the second post in this series addressing my perspective on the current state of Cybersecurity Incident Response training and an approach to improve interest, participation, and expanded learning. Part I can be found here.

Part II: Party Chat vs. Whispered Scrolls

The dragon is near.  The ranger spots it.  The mage has an idea.  The rogue is checking for traps.  The barbarian… is smashing things.  But no one is talking to each other.

Sound familiar?

Welcome to a typical table-top exercise where the parties are technically all in the same room, but operationally acting like solo adventurers in different realms.

When silence is the loudest failure in the room…

Welcome to The Communication Gauntlet: the invisible challenge your party must overcome before the actual threat even arrives.  It is the awkward moment when the SOC analyst assumes Legal was briefed.  When IT patches a server in the middle of evidence collection.  When PR prepares a holding statement before anyone knows what’s being held.

At its worst, it is the silence that creeps in, not due to fear, but confusion.  “Is that my responsibility?” “Do I have the authority to share this?” “Should I even speak up?”.  And suddenly, the Gauntlet becomes a maze, not a bridge.

This is why tabletop exercises must stress not just what you say, but when and how you say it.  Timely, accurate communication is a team-wide buff.  Poor communication?  That is a lingering debuff, one that compounds every other misstep.

When teams have never practiced talking through a real-world scenario, even the best-written incident plans can fall apart faster than a novice mage’s polymorph spell.

The Splintered Party: A Trap Sprung in Coordination

It starts with urgency, the party realizes something is wrong.  But instead of rallying as one, they scatter, each following their own instincts and interpretation of the threat.

The Warrior, ever action-oriented, grabs their weapon, or in this case their phone, and calls the help desk.  They want answers fast, but the questions aren’t aligned with the rest of the party’s plan.

The Wizard, wise and rule-bound, seeks higher authority.  They immediately escalate the matter to Legal, invoking old scrolls of precedent and regulation. Useful, perhaps, but prematurely summoned.

The Cleric, always focused on healing the damage, fires off a message to leadership.  It is earnest, filled with concern, but untethered from the evolving facts on the ground.

The Rogue?  Ever the lone wolf, they don’t speak a word.  Instead, they silently begin disabling accounts, confident in their judgment, but unaware they’ve just destroyed a vital source of evidence.

Meanwhile, HR, the often-overlooked NPCs in this campaign, are still in a separate room, rolling their own initiative for a completely unrelated campaign.  No one brought them into the fray, and no one’s told them they’re needed…yet.

Each move, in isolation, might seem reasonable.  But without shared direction, it's a cacophony of misfires.  A party reacting, not responding.  A campaign where the threat isn’t just the attacker... it’s the disarray within the defenders.

This fractured adventuring party scenario plays out time and again when teams have not practiced cross-functional collaboration under pressure.  They each play their class well, but without shared knowledge of each other's tactics, or the awareness of when to call for backup, the result is chaos.

Table-top exercises expose this communication entropy, where messages are either lost in translation or cast into the void like a misfired sending spell.

A Party Divided Is a Party Defeated

Even the most elite characters, your Paladin of IT Ops, your Rogue of Security, your Cleric of HR, are only as effective as their coordination allows.  A divided party rarely realizes it’s divided until the damage is already done.

The incident begins, and every team springs into action, but not together. Each group responds to what they believe is most urgent, operating on its own internal clock rather than a shared timeline.  Security is chasing indicators of compromise, IT is racing to restore availability, and Legal is quietly trying to understand exposure.  Everyone is moving fast, yet no one is moving in the same direction.

Decisions start happening in isolation.  One team revokes access to a critical system to contain risk, unaware that another team is actively monitoring that same system to preserve evidence.  Neither decision is wrong on its own, but without coordination, both undermine the larger objective.  The left hand doesn’t know what the right hand is casting.

Communication, when it does happen, often misses its mark.  A well-intentioned 14‑paragraph email is sent mid‑incident; detailed, thorough, and completely overwhelming; to an audience that isn’t even part of the response effort.  Meanwhile, the people who do need to know what’s happening remain in the dark.  The executive sponsor hears nothing until the first call comes in from outside the organization, asking for comment on an incident they didn’t know was unfolding.

None of this happens because teams don’t care or lack skill.  It happens because the party never practiced moving as a unit.  Each role is playing correctly, but without alignment, the result is chaos instead of coordination.  The fight isn’t lost to the dragon, it is lost to silence, assumptions, and missed signals.

These disconnects are not necessarily signs of incompetence.  They’re potentially signs of siloed excellence. Where individuals are high-performers, but no one is wearing the headset that links the raid party.

This is why it is recommended to assign “liaison roles” in your tabletop exercises.  Not just note-takers or observers, actual players designated to listen, share, and cross-talk between teams.  Think of them as the Bard who might not carry the heaviest weapon, but ensures everyone hears the call to arms.

You do not need perfect harmony.  You just need practiced rhythm.

DUNGEON MASTER’S NOTE: What Spell Was That?

In our sessions, I often witness a spell-like ability called the “Assumption of Alignment.”  This occurs when a team member believes they communicated a decision clearly… but didn’t.  Or worse, they assume someone else “must have” handled it. In tabletop terms: a failed Perception check with no one rolling Insight.

Scroll of Shared Language: Translating Between Teams

Let’s be honest: Security doesn’t speak Legal.  Legal doesn’t speak Network.  Network doesn’t speak PR.  And PR definitely doesn’t speak Forensics.

Table-top exercises are the perfect opportunity to develop a shared glossary of terms, clarify command channels, and assign "party leaders" (with rotating initiative) to be spokespeople for their department.  Think of it like casting Comprehend Languages across the entire campaign.

We encourage the use of visual aids, diagrams, timelines, chat logs as part of each turn in the exercise.  When each team presents actions and impact as part of a continuous narrative, the fog of war starts to lift.  Instead of siloed moves, the party begins to flow.

Party Tip: Equip the Sending Stones

Assigning communication leads per domain team can help synchronize response cadence. These players should practice:

• Relaying accurate updates in a compressed format
• Confirming task ownership explicitly
• Calling for clarification when plans conflict
• Keeping the whole table informed on status effects (aka business impact)

Think of it like equipping your party with upgraded Sending Stones, limited, but powerful messages when wielded wisely.

Because how we tell the tale defines how we remember the battle…

The Bard Was Right: It is About the Story

Every campaign has a story.  And every incident, simulated or real, is a moment where the story either becomes folklore… or gets lost in the fog.

When tabletop participants are encouraged to narrate their actions, not just list them, something magical happens: Others begin to listen.  They ask follow-ups.  They ask why decisions were made, not just what was done.

Instead of saying:
"We locked the accounts."
Say:
"Our rogue spotted lateral movement and chose to eliminate the threat by locking the accounts.  We didn’t yet know if that would interrupt legal's data preservation task, but time was critical."

This shift from action-only to storytelling builds bridges.  Those bridges persist long after the table-top ends.

This story-first approach helps combat the “Spotlight Effect,” where only a few voices dominate, reduces finger-pointing and boosts empathy across departments.  It turns “why did you do that?!” into “I didn’t realize that was your constraint, here’s how we can help next time.”  You get more “I remember when...” moments, and that’s where learning embeds.

The result is not only operational improvement, but increased camaraderie.  When a real incident occurs, that trust is already built.

XP Unlocked: Lessons from the Dungeon Floor

Every table-top comes with a moment when the map is cleared, dice are set aside, and the adventurers lean back to assess the campaign.  It is not just a recap, it is a reckoning.  The true rewards of the quest aren’t in the treasure, they’re in the experience gained.  When communication is the core of the encounter, the XP earned reveals something profound.

The first realization is that shared understanding consistently outperforms individual brilliance.  No matter how skilled a player may be; whether casting detection spells, negotiating with vendors, or investigating logs; a fractured response will always fall short.  It is the synchronization, not the solo, that wins the battle.

Then, there’s the language of the realms.  Department-specific jargon must be translated if the party is to move as one.  What the SOC calls an "IOC," Legal might call “evidence,” and HR might call “a personnel matter.”  Without alignment on meaning, even the clearest messages become cryptic scrolls written in a forgotten tongue.

A surprising hero often emerges mid-battle: the communicator.  Communication Leads prove to be as valuable as fireballs.  Less flashy, perhaps, but far more effective in uniting the party’s efforts.  When things spiral, the voice that guides, shares, and tracks the flow of information becomes a critical spell in your organizational spellbook.

What truly binds the adventuring party together, though, is narrative engagement.  When the exercise is more than just checklists and control validation.  When it feels like a real quest, players engage differently.  They begin to empathize with each other’s burdens, recognize overlaps, and see the full tapestry of the event.  The magic happens when HR feels the urgency of the SOC, and the SOC understands Legal’s cautious pace.

And finally, the scrolls must be written.  Documenting how and why things unfolded turns fleeting insight into lasting lore.  These records don’t just serve audits, they build institutional memory.  They help the next group of adventurers start with knowledge instead of guesswork.

Because every campaign leaves behind XP.  The only question is whether you’re tracking it.

And yes, occasionally, someone still sets the tavern on fire.  But at least everyone knew about it in real time.

Call to Action: Rally the Party

For your next table-top, go beyond the usual test of technical capabilities.  Make communication the central boss fight.

Have teams declare their actions as if in a campaign.  Require a shared recap phase.  Introduce fog-of-war elements or information silos, and watch how teams bridge the gaps, or fail to.

Then hold a Tavern Debrief.  Review what worked, where assumptions led astray, and how the party can improve on the next quest.

Communication isn't just a tool, it's a skill check.  Like all skills, it improves with practice.

In the next installment, we’ll ascend the steps of the Citadel to sit with the High Council, where leadership alignment (or lack thereof) can inspire a heroic defense… or trigger a political boss battle more dangerous than any exploit.

Until then, keep your scrolls handy, your comms open, and your party strong.