It's 2 AM. A hacker is inside your company right now, moving from machine to machine while your customer data walks out the door. The next hour decides everything. What will you do?
A safe, fictional simulation — nothing on your machine is touched. The deadlines are real ones: CERT-In requires notification within 6 hours, and volatile forensic evidence really does decay in minutes.