Summary

A small digital agency notices strange traffic on a client’s knowledgebase site and blocks what looks like a competitor’s scraper. Then it finds that a contributor nobody remembers approving changed a citation tool setting on a second client’s site, and that an account nobody knows left odd notes on a third. Built for agencies and MSPs that host many clients on one platform, with the founder, delivery, engineering and customer success in the room. It tests what the team does when the threat actor is a crowd of automated AI agents.

Ground rules

• This is a no-fault discussion. Disagreement is expected, and nobody is being graded as a person.
• There are no trick questions. Some reports in this story will turn out to be wrong, as they do in real incidents, but the narrator never misleads you.
• The facts are as the facilitator reads them. Work with what arrives.
• Answer with the people, tools and plans you have today.
• Have your own incident response plan open. Some questions ask what yours says.
• Decisions are not precedent setting and may not reflect your organization's final position on a given issue. This exercise is an opportunity to discuss and present multiple options.

Setting

Copperleaf Digital, a twenty-two-person agency, builds and hosts community knowledgebase sites: a trade association’s member handbook, a library cooperative’s resource guide, an open hardware project’s documentation wiki, and nine others. Every client site runs on one shared platform in a single public cloud account. Copperleaf staff sign in through one identity provider with single sign-on. Client contributors have their own accounts on each site and each client decides who gets promoted to “trusted contributor.”

Every site shares two features:

1. The citation tool lets a contributor paste a link and have the platform fetch the page title and a short summary, so footnotes look tidy.

2. The scratchpad lets contributors leave working notes for one another.

Trusted contributors can change the citation tool’s settings for their own site, including which sources it is allowed to fetch from.

Nadia Ferreira is a security contractor who works for Copperleaf two days a week and runs her own practice the rest of the time. The incident response plan names Nadia as the person who decides when a shared feature comes down.

Roles at the table: Celeste Imbert (founder), Elif Marchetti (head of delivery), Sam Reyes (platform engineer) and Lena Hart (client success).

The first sign

Wednesday, 10:15. Sam gets a hosting cost alert: outbound traffic on the trade association’s site is four times its usual level for a weekday morning. The alert fires about once a month, usually when a client sends a newsletter.

Sam opens the access logs. The visitors claim to be ordinary browsers, though they behave like no person does: hundreds of pages a minute, straight down into archive pages nobody has opened in years, each page visited once and never again. Sam posts a screenshot in the engineering channel with the comment “bots again” and goes back to a deploy.

What happens next

T+20 minutes. Elif sees the screenshot and remembers that a rival agency pitched the trade association last month. Sam finds that a large share of the requests carry the same unusual fragment in their browser description and come from addresses belonging to one cloud provider. The client’s director, told informally, says it is probably the rival copying their content. Sam drafts a block on that fragment and a rate limit on the whole platform, ready to ship before lunch.

Ask the room: Does the block ship, and who approves a change that applies to all twelve clients? What gets saved from the logs before anything changes? Is this an incident yet, and who decides?

T+45 minutes. The block ships. Traffic drops for eleven minutes and then returns at the same pace, now with ordinary browser descriptions and from addresses that look like home internet connections spread across several countries. The new requests go somewhere the old ones did not: the citation tool’s preview page and the “edit settings” screen of several client sites.

Ask the room: What was the rival-agency theory based on, and what would have tested it before the block shipped?

T+70 minutes. Lena, doing a routine weekly review of the library cooperative’s edit history, finds a change made two days ago to a site’s citation tool settings. The list of allowed sources now includes an address nobody recognizes, and the fetch limit has been raised so the tool pulls whole pages instead of a summary. The change came from a trusted contributor account promoted three weeks ago. Nobody at Copperleaf, and nobody at the cooperative, remembers approving that promotion.

Ask the room: Do we revert the setting now, or leave it in place while someone studies it? What is lost either way? Who at the cooperative needs to hear about this, and who tells them?

T+85 minutes. Sam wants to turn the citation tool off on every client site, since all twelve share the same code. Nadia, who the plan says makes that call, is unavailable. Celeste is in a sales meeting with her phone off. Elif points out that three clients are launching new sections this week and their editors use the citation tool on every page.

Ask the room: Who can take a shared feature away from every client when the person named in the plan is unreachable? Does your plan name an alternate in similar circumstances? If the tool stays on, what is the team watching, and for how long?

T+100 minutes. Lena gets a message from a volunteer moderator on the open hardware wiki. The shared scratchpad there has filled overnight with dozens of notes from an account nobody knows. They read like a to-do list being worked through: “step 4: confirm preview returns full body for internal address; if blocked, retry with alternate encoding.” Two of the notes mention the same unknown address from the library cooperative’s settings. The moderator has already asked about it in the project’s public forum.

Ask the room: Is this the same incident as the traffic and the settings change, or a second one? What does Lena tell the moderator, and does anything need to be said in that public forum? Does the team delete the notes, keep them, or hide them?

T+130 minutes. Sam pulls the citation tool’s outbound log for the past three days. The tool made several thousand fetches under the cooperative’s altered settings. A handful went to addresses that only exist inside Copperleaf’s own hosting network. The log records that each request was made and whether it succeeded. It does not record what came back. Sam cannot tell whether these requests come from one operator, several, or software running loose with nobody steering it.

Ask the room: What can the team say it knows, and what can it only guess? Does it matter who is behind this for what the team does in the next hour? Who else outside the company, if anyone, should be looking at these logs?

T+160 minutes. The library cooperative’s director emails Celeste directly. Their member directory, with names, home addresses and membership dues status, lives on the same platform. “I need a yes or no before my board meets tomorrow morning: did our members’ information leave through your tool?” Sam checks the outbound log once more. One of the internal addresses the citation tool fetched, twice, with success both times, is the one that serves the cooperative’s member directory.

Ask the room: What does Celeste write back today, and who reviews it before it goes? What can Copperleaf honestly say about whether the directory left, and what can it not? Do the other eleven clients hear about this before they ask?

Standing questions

• Does the person running this have the authority to change something every client depends on?
• What is the team calling this (an incident, a breach, abuse of a feature, unknown), and on what evidence?
• When the actor cannot be identified, what does “contained” mean, and who decides the team has reached it?

Generic rubric

Did the team:

• Name an incident lead early, and did everyone at the table agree who that was?
• Name someone to keep a timed record of every decision and action as it happened?
• Assign someone to communications who was not also working on the incident itself?
• Decide, against criteria they could state, whether this was an incident and how severe it was?
• Decide when leadership would hear about it?
• Establish who could authorize high-impact actions, such as taking a system offline?
• Decide who acts when that person cannot be reached?
• Determine whether this is a security incident, a data breach, a contractual matter, or some combination, and on what evidence?
• Check how far it reached beyond the first system they found?
• Keep a current list of what is known, what is suspected and what is unknown?
• Weigh containment against investigation before acting?
• Preserve the logs and other evidence before taking any action that would alter them?
• Check what their customer agreements say about incidents and notification before drafting anything for a customer?
• Check what their vendor agreements say about incidents, in both directions?
• Call legal, or decide explicitly not to, at the point they first suspected unauthorized access?
• Make an explicit decision about contacting law enforcement?
• Check their cyber insurance policy's notice and consent terms before engaging outside responders or discussing payment?
• Agree one approved message for staff, customers and leadership?
• Send it over a channel they had reason to trust?
• Test the competitor theory against evidence before acting on it, and revisit it once the traffic changed shape?
• Avoid stating in any client message what the logs cannot show, in either direction?
• Consider whether anyone outside the company (a hosting provider, a researcher, another affected organization) could help explain who or what was behind it?

Postmortem prompts

• The first alert looked like a newsletter spike. What would have flagged the settings change on Monday, or the promotion three weeks before it, instead of Wednesday’s traffic?
• A trusted contributor was promoted and nobody remembers approving it. Who can grant that role on each site, and who reviews it afterward?
• The citation tool could reach addresses inside Copperleaf’s own network. Who decided what it was allowed to fetch, and when was that last looked at?
• The plan named one part-time person for the decision that mattered most. What did the team do in her absence, and was it written down anywhere beforehand?
• The outbound log kept that a fetch happened but not what came back. Which other logs on the platform have the same gap?