Anna: This section sets up Capstone: Red Team Your Friend's Startup. Treat it as the frame for the decisions, handoffs, and evidence that appear in the next slides.
Greg: The practical question is simple: by the end, what should a junior IT professional be able to explain, check, or document in a real workplace?
Anna: [energized] This capstone is your chance to break things safely. We pressure-test a 15-person startup without touching their production stack.
Greg: The goal is to practice red-team curiosity, blue-team calm and facilitation skills that keep stakeholders engaged instead of defensive.
Anna: We finish by translating every insight into a maturity score and a backlog leaders can actually fund.
Greg: And along the way we highlight the cross-functional cast—fractional CTOs, success managers, ops leads—who make improvements stick.
Anna: Our scenario centers on Sarah's marketplace startup—fifteen people juggling weekly releases, contractors and a global customer base.
Greg: Their stack is modern but stitched together: managed Kubernetes, GitHub Actions, Google Workspace, Notion, HubSpot, Stripe.
Anna: They lean on a fractional SOC, an MSP for laptops and an offshore labeling partner, so third-party trust boundaries really matter.
Greg: Pain points are already on the table: ad-hoc onboarding, shadow SaaS creep, almost no incident rehearsal and compliance debt chasing them into every sales call.
Anna: We split into pods of five or six—red-team analysts, blue-team responders, a business voice and a scribe.
Greg: Ninety minutes goes fast, so the facilitator guards the timeboxes: twenty for recon, thirty for the live drill, twenty-five to debrief, fifteen to prep the share-out.
Anna: Injects keep everyone honest, but the tone stays curious, not accusatory.
Greg: Everything you need lives in the shared workspace—architecture map, SaaS inventory, contract snippets, customer personas—so no one is guessing.
Anna: Phase one is pure recon. The red team maps assets, data flows and every third-party touchpoint they can spot.
Greg: We ask for the top three attack vectors—with evidence. Credential reuse? Misconfigured S3 buckets? Vendor breach cascading into production?
Anna: Each threat must tie back to business impact so sales, support and engineering leaders understand the stakes.
Greg: The scribe logs unanswered questions to keep momentum while still capturing gaps for later homework.
Anna: In phase two, the facilitator picks a scenario—maybe a compromised GitHub token that poisons container images.
Greg: Blue-team responders narrate how they'd spot it, contain it, communicate with customers and loop in legal or finance.
Anna: Injects keep tension high: a product launch collides with the incident, the MSP contact is offline, the SOC queue is overflowing.
Greg: We encourage teams to draft customer updates, board brief talking points and even postmortem outlines while the adrenaline is still flowing.
Anna: Debrief time means switching to evidence-based grading. Each pod scores people, process, technology and governance on a one-to-five scale.
Greg: We tie every score to artifacts—outdated runbooks, missing tabletop cadence, a single approver on critical releases.
Anna: Then we prioritize the backlog: lightning fixes like closing MFA gaps, medium-term plays like renegotiating vendor contracts, strategic bets like observability upgrades.
Greg: Finally, we capture what leadership must unlock—budget, headcount, or policy—to sustain momentum.
Anna: The maturity model keeps scoring consistent. Level one is ad hoc—heroics, no playbooks, barely any logging.
Greg: Level two is emerging: some runbooks, partial MFA, retros that happen but rarely translate into change.
Anna: Level three is scaling—quarterly tabletops, defined SLAs, vendor scorecards, baseline observability.
Greg: Level four is measured with automated controls, resilience OKRs and real budgets; level five is optimized, where purple teaming and partner collaboration are business as usual.
Anna: Each pod leaves with tangible artifacts: a risk map, attack narrative, maturity scores and a remediation backlog with owners and timelines.
Greg: Visuals help—journey maps, swimlanes, heat maps make executive conversations concrete rather than theoretical.
Anna: We use a "start, stop, continue" debrief to surface cultural shifts alongside technical fixes.
Greg: And everyone closes with a commitment statement so momentum carries beyond the classroom.
Anna: The exercise spotlights multiple roles: fractional CTOs, security leads, product managers, customer success managers, operations analysts.
Greg: Entry points vary—support engineers stepping into incident command, consultants shifting into virtual CISO work, operations generalists owning vendor programs.
Anna: The standout traits are facilitation under pressure, systems thinking, empathy for non-technical teammates and curiosity about adversary tradecraft.
Greg: Nail this capstone and you're charting a path toward security program management, resilience leadership or platform engineering direction.
Anna: The takeaway is simple: rehearsal builds muscle memory faster than policy memos ever could.
Greg: By red-teaming Sarah's startup together, we generate evidence-backed maturity scores and a sequenced roadmap that leaders can champion.
Anna: Treat the session like prep for the next diligence meeting—you want answers ready before investors or auditors ask.
Greg: And the real win is renewed shared accountability before the inevitable real-world incident arrives.