The point of OPERATION DANGER CLOSE is not to teach a framework. It is to put a person in a chair, hand them a title, and make them answer for a decision while the clock runs. On August 13, twenty-three students at Baruch College found that out inside the first ten minutes. There were no observers. Every seat carried a role, and every role had to speak.
The pilot was delivered in collaboration with Sentricus and hosted through the NYC Tech Talent Pipeline at Baruch College, the program that connects CUNY students to the employers who need technology talent. That matters to the design. These were not cybersecurity specialists being tested on cybersecurity. They were students being asked to make the calls a leadership team actually has to make.
Four roles, five phases, no laptops
Each participant was assigned one of four executive positions. Chief Executive, Incident Commander, Chief Information Security Officer, and Legal, Compliance, and Communications. Teams then moved through five escalating phases of a breach at a third-party file transfer provider, the kind of vendor that sits quietly in the middle of a bank's operations until the day it does not. There was no lab environment and no software. Printed materials, a facilitator, and a clock.
What the teams actually had to decide
The hard part of a breach is not the technical detail. It is that several clocks start at once and they do not agree with each other. Regulatory notification windows open before anyone knows the scope. A ransom demand arrives before legal has an opinion, and business continuity questions land on the Chief Executive while the Chief Information Security Officer is still trying to establish what was taken and when.
Teams found that out quickly. The most common failure was not a wrong answer. It was silence, or a decision made by whoever spoke first while three other roles held information that would have changed it. That is the same failure that shows up in real institutions, and it is why the format puts every participant in a named seat rather than in an audience.
The scenario was not invented. It mirrored a managed file transfer compromise from 2023 that moved through the financial sector by way of a shared vendor, reaching institutions that had no direct relationship with the attacker and no control over the software that let them in. The parallel was revealed at the close, not at the start. Participants made their calls blind, then learned what had happened to the organizations that faced the same facts.
What participants said afterward
Participants completed a satisfaction survey at the close of the session. Satisfaction was measured at 100 percent, across a group that had just spent ninety minutes answering questions they had no preparation for and no comfortable answers to. That is the result the pilot was built to test. A format that leaves people feeling exposed rather than equipped does not get invited back.
See how it played out
A recap can describe the format. It cannot show you what a team looks like when it realizes the notification clock started two phases ago. The session and debrief run seven minutes and twenty-four seconds on video, which is the fastest way to understand what the exercise feels like from the inside.
Why the format travels
The constraint set is the point. An exercise that requires a laboratory environment, specialized software, or a dedicated facility is expensive to schedule and easy to postpone. This one runs in any ordinary conference space, holds five to thirty participants, and fits inside a class period, a lunch briefing, or a board session. Moving from students to a board or an agency staff is a change of framing, not a redesign.
Participants do not leave with notes. They leave having held a role and answered for a decision under time pressure, which is a different kind of preparation and a more durable one. That was the outcome the pilot was built to test.
Thanks to Darion Cole, Talent and Partnership Development Manager for the Tech Talent Pipeline at Baruch College, for hosting and for bringing these students in, and to Kermit Middleton for co-facilitating.
OPERATION DANGER CLOSE is available for university programs, executive teams, boards, and agency staff. The program page has the format details and the exercise kit.