Training mode

This walkthrough gives the answer away on purpose. Read it once to learn how the evidence works, then play a fresh case for real.

The Silent Airframe Ghost in the Bid Telemetry Drift The Quiet Rotation Change Order Echo Signing Key Shadow

Signing Key Shadow

Vantage Control Systems, an industrial software firm

Source code and code-signing material for a flight-control component left the network.

The cast

Dmitri Salvatore — Build and release engineer. Disabled a pipeline check 'temporarily'.
Nkechi Balogun — Principal developer. Working two jobs on company time.
Tomas Alvarez — Security architect. Blocked a control he had designed.
Willa Bright — Product manager. Leaks roadmap details to customers.
Ori Ben-Ami — Site reliability engineer. Keeps a personal runbook of secrets.
Camille Duprée — Technical writer. Requests access she never uses.
Hugh Renwick — Sales engineer. Demo laptop is unmanaged.

Clue by clue

CLUE 1

A crash dump with high entropy and no stack frames

How you surface it: Have forensics inspect the dump rather than trusting its extension.

Why it points at the insider: File type is a claim, not a fact. Entropy analysis exposes disguised archives.

CLUE 2

Vendor-portal upload from a workstation with no open ticket

How you surface it: Correlate outbound uploads with the ticketing system.

Why it points at the insider: Legitimate channels used without legitimate context are the insider's favourite cover.

CLUE 3

Secrets pulled from the vault into a local file

How you surface it: Review secret-vault access logs for bulk reads.

Why it points at the insider: Vault reads are the earliest possible warning for key theft — alert on volume, not just failure.

CLUE 4

Resignation timed to the upload window

How you surface it: Cross-reference HR events against the incident timeline.

Why it points at the insider: The 30 days around a resignation are the highest-risk window in insider risk. Monitor accordingly.

Innocent explanations you must rule out

Dmitri's disabled check was reinstated the same day and logged.
Nkechi's moonlighting is an HR matter with no data movement.
Hugh's unmanaged demo laptop never held source code.

The answer

Ori Ben-Ami is the insider. Motive: A signed competitor offer with a delivery expectation attached. Method: An encrypted archive disguised as a crash dump, uploaded through a vendor support portal.

Timeline: Day -35 offer signed; Day -28 pulls secrets into a local runbook; Day -21 creates the fake crash dump; Day -20 uploads via the support portal; Day -14 resigns; Day 0 signed binaries appear from an unknown publisher.

Lessons to carry into the game

Treat the resignation window as an elevated-risk period.
Inspect file content, never file extension.
Alert on bulk secret reads from the vault.

Play a fresh case Play this case