A branching, choose-your-path tabletop built for a logistics company with a headquarters campus and dozens of distribution centers. A former employee is making escalating threats, and nobody knows where he is. Six shared injects establish the threat, then the room's own decision — close the campus, or keep it open with enhanced security — sends the exercise down one of two independent, fully-scripted paths. Neither one makes everyone feel safe.
Every detail below is fictional — specific enough to feel real in the room, and generic enough to map onto almost any organization with people across many sites and a threat that doesn't respect any of them.
A third-party logistics company headquartered in Columbus, Ohio, with ~11,000 employees: 1,200 at its headquarters campus and the rest across 26 distribution centers in nine states. It handles warehousing and fulfillment for retail and consumer brands, and its distribution centers run around the clock.
Brennan has a threat assessment team on paper — HR, security, legal, and an outside consultant — that has met twice in three years. Its headquarters has badge readers but no visitor screening. Its distribution centers have security at the truck gates, where the company has always thought the risk was.
Six injects, delivered over the first 22 hours, that every player experiences regardless of what the room ultimately decides. This phase ends with the decision that splits the exercise in two.
An employee forwards HR a screenshot: a warehouse supervisor terminated three weeks ago has posted online about "making them pay," alongside a recent photo of the headquarters parking lot.
The threat assessment team learns that two coworkers had reported concerning behavior before his termination, and his manager never escalated either report. His badge was disabled, but his parking access tag still works.
Local police review the posts. They tell Brennan the posts don't meet the threshold for an arrest, but they'll do a welfare check at his home this evening.
His former spouse, an analyst at headquarters, tells HR he has been calling her repeatedly and she's afraid. She asks what the company can do to protect her.
Police report that he wasn't home during the welfare check and his car is gone. Overnight, he posted again, this time naming a senior HR leader.
1,200 people start arriving at headquarters in 90 minutes. The room has two options: close the campus and move everyone to remote work until he's located, or keep it open with off-duty police officers, visitor screening, and a security presence at every entrance. The distribution centers have no such options ready. The room has to decide.
From here, the facilitator runs one of two fully independent scripts depending on what the room chose in Inject 6. Toggle between them below to see how each one unfolds — in a live session, players only ever see the one they earned.
An all-staff message goes out closing the campus "due to a security concern." Within minutes, employees are speculating in group chats — and some guess who it's about.
Payroll, the network operations center, and a customer command center need people on site. About 140 employees are classified as essential, and some of them don't want to come in.
Distribution center employees ask why headquarters is closed but their sites aren't. One distribution center is 20 minutes from his home, and its general manager has heard nothing from corporate.
Local news reports that Brennan closed its headquarters because of a threat. Customers call their account managers asking if their shipments will be affected.
He still hasn't been located. Leaders debate how long the campus can stay closed and what would have to be true to reopen it. Nobody has defined that.
The targeted employee can't stay at home and doesn't feel safe at a relative's. She asks whether the company can help with temporary housing and paid leave. There's no policy for this.
A distribution center supervisor reports seeing a car matching his in the employee lot. The site initiates its lockdown procedure for the first time. Some doors don't secure, and the overhead announcement can't be heard in the loading area.
Police take him into custody on an unrelated warrant. His attorney says he'll likely be released on bond within days. Employees ask whether it's over.
The room must decide whether to reopen headquarters now, with what security measures, and for how long — and whether to apply the same measures at the distribution centers. The room has to decide.
The post-incident review focuses on the two behavior reports that were never escalated before his termination, and on an offboarding process that disabled his badge but not his parking access.
Off-duty officers are posted at entrances, bags are checked, and visitors are turned away. Employees arrive to a visibly changed building and an all-staff message that says very little.
About 200 employees ask to work remotely. Some managers approve every request; others refuse and say the building is safe.
The targeted employee insists on coming to work — she says it's the only place she feels safe. Security wants her to work remotely. HR isn't sure the company can require it.
Security spots a car matching his in the parking area and orders a shelter-in-place. It turns out not to be him. But the drill exposed problems: the announcement couldn't be heard in two buildings, and several interior doors don't lock.
Distribution center employees ask why headquarters has armed officers and they have nothing. One distribution center is 20 minutes from his home, and its general manager has heard nothing from corporate.
An employee posts a video of the shelter-in-place online. It spreads locally, and reporters start calling.
Police take him into custody on an unrelated warrant. His attorney says he'll likely be released on bond within days. Employees ask whether it's over.
An employee's attorney sends a letter alleging the company knowingly kept employees in an unsafe workplace. Others are asking whether they can refuse to come in.
The room must decide which security measures stay permanently — visitor screening, officers, lockable doors — at headquarters and the distribution centers, and how to pay for them. The room has to decide.
The post-incident review focuses on the two behavior reports that were never escalated before his termination, and on an offboarding process that disabled his badge but not his parking access.
The two paths are built to converge on the same hard questions, arrived at from opposite directions.
The full Brennan scenario — every inject, both paths, and the debrief questions — is available as a print-ready PDF you can share with your own team or board. Enter your email and we'll take you straight to the download.
The Brennan exercise is a sample — built to show how a workplace threat simulation can branch on the decision that actually matters, and stay uncomfortable in both directions. A simulation built for your organization starts with your sites, your people, and your threat assessment process.
Exercises often require access to crisis plans, escalation structures, and vulnerabilities. That material is handled in confidence, and NDAs are available on request.
Talk to us about a custom simulation →
The Crisis Studio