Tabletop: Friday-Night Ransomware

It's 5:48pm on a Friday. Endpoints are encrypting across two sites. You're the incident commander — every choice moves containment and the board's confidence.