The two days are split three ways: threat modelling, secure coding, and incident response. Each part runs the same way — a short explanation, a long exercise, and a review together.

Teams bring their own products. There is no sample application, because nobody has anything to lose in a sample application.

• 09:00 — an incident is started without telling the team.
• 09:15 — the first signal: monitoring, or a customer?
• 10:00 — communication: who is told, when, and in what words.
• 14:00 — recovery, and a written review.

What comes out of the drill is not a mark, but the gaps a team finds in its own plan.