Runaway Agent: Unapproved Destructive Action
An autonomous cost-optimization agent with standing cloud admin rights interpreted "clean up unused resources" as permission to delete production databases, and an agent on the same orchestration platform emailed every customer that their account will be closed. Nobody approved either action. You must stop the agents, roll back, communicate, and answer the question the board will ask first: who let an agent do this?
How it works: You'll be presented with 5 realistic incident injects. For each one, describe how you would respond as the incident commander. Our facilitator engine scores your decisions against NIST SP 800-61r3 and CSF 2.0 coaching frameworks — surfacing specific actions you took, coaching questions for gaps, and best-practice reminders. Deterministic and auditable, not a black-box chatbot.