Training mode

This walkthrough gives the answer away on purpose. Read it once to learn how the evidence works, then play a fresh case for real.

The Silent Airframe Ghost in the Bid Telemetry Drift The Quiet Rotation Change Order Echo Signing Key Shadow

The Silent Airframe

Northwind Dynamics, an aerospace supplier

CAD assemblies for a classified airframe program surfaced on a broker forum eleven days after an internal design freeze.

The cast

Priya Raghunathan — Senior CAD engineer. Badge-ins at 02:10 three nights running.
Marcus Devlin — IT infrastructure lead. Kept a personal admin account nobody approved.
Sean Gallagher — Quality assurance manager. Sudden interest in the plotter room.
Alina Moreau — Procurement analyst. Recruiter email flooding her inbox.
Devon Clarke — Security operations analyst. Muted his own DLP alerts twice.
Hana Oyelaran — Program manager. Unreported lost laptop from a trade show.

Clue by clue

CLUE 1

Plotter job queue outside his product line

How you surface it: Pull print/plotter logs and cross-reference job owner to program assignment.

Why it points at the insider: Print channels are the classic DLP blind spot. Access that is technically permitted but contextually wrong is the strongest early insider signal.

CLUE 2

Badge egress during the fire-alarm test

How you surface it: Request badge records for the alarm window.

Why it points at the insider: Insiders time physical exfiltration to moments when normal controls are suspended. Correlate physical and digital timelines, always.

CLUE 3

PLM read spike with no design edits

How you surface it: Ask for UEBA baselines on file-read counts per user.

Why it points at the insider: Read-heavy, write-free behaviour is collection, not work. Baselines beat thresholds.

CLUE 4

A dormant LLC registered in his spouse's name

How you surface it: Ask HR/legal for conflict-of-interest disclosures and open-source business filings.

Why it points at the insider: Motive is evidence too — but it must be gathered lawfully and through HR, not by snooping.

CLUE 5

Print-room camera stills

How you surface it: Request facilities CCTV for the plotter room, with chain of custody.

Why it points at the insider: Corroborating evidence turns a theory into a case. Handle it so it survives review.

Innocent explanations you must rule out

Priya's 02:10 badge-ins are a deadline crunch her manager approved verbally.
Devon muted DLP alerts because of a noisy false-positive rule he was retuning.
Marcus's rogue admin account is lazy convenience, not theft.

The answer

Sean Gallagher is the insider. Motive: A side consultancy he built on company IP after being passed over for director. Method: Printing full assemblies to a rarely-audited plotter, then photographing the prints off-site.

Timeline: Day -20 recruiter contact; Day -14 first plotter job outside his product line; Day -12 and -9 further jobs; Day -8 walks prints out during a fire-alarm test; Day 0 listing appears on the broker forum.

Lessons to carry into the game

Print and physical channels need the same monitoring as email and cloud.
Correlate badge, print and file-access timelines before interviewing anyone.
Interview last: early interviews tip off the insider.

Play a fresh case Play this case