What can we say at 09:15?
A clear draft can still invent a cause. Separate confirmed impact from what the team has yet to establish.
“It's not like you can outsource your judgment, but you can augment it.” (opens the source)
The question
Meridian runs 40 service sites. An AI draft says a cyberattack closed the whole network. The incident team has not established a cause. A public update is due in 30 minutes. These are invented, time-stamped observations.
| 09:15 | |
|---|---|
| Currently affected | 6 |
| Working and checked | 22 |
| Not yet checked | 12 |
This is the current 09:15 snapshot. The counts total 40 sites.
“Give the first statement, name the unresolved fact, then revise it for 09:45.”
Not saved by this site. Your browser may restore text when you navigate back.
A strong answer, step by step
Open each step in turn. This is one strong answer, not the only one.
Step 1: State confirmed impact
What would you do here? Open the move you’d make.
Say the entire network is down.
Tempting, but it misses something. Twenty-two sites were checked and working.
Name six affected sites and 12 unchecked.
The strong move. Unchecked sites do not establish either normal service or failure.
See how a strong candidate says it
“Six of 40 sites are confirmed affected; 12 are unchecked. Say those counts. Fifteen percent is confirmed impact, not the final incident rate.”
Why it works: Unchecked sites do not establish either normal service or failure.
Step 2: Keep the cause open
What would you do here? Open the move you’d make.
Keep the cause under investigation.
The strong move. A polished draft is not evidence of causation.
Deny a cyberattack to reassure customers.
Tempting, but it misses something. The cause has not been established.
See how a strong candidate says it
“Say the team is working to restore service and establish the cause. The packet supports neither a cyberattack nor a denial of one.”
Why it works: A polished draft is not evidence of causation.
Step 3: Make a clear update commitment
What would you do here? Open the move you’d make.
Promise full recovery at 09:45.
Tempting, but it misses something. No restoration forecast is supplied.
Promise the next update at 09:45.
The strong move. The team can control the next communication even while repair timing is uncertain.
See how a strong candidate says it
“At 09:15, a 30-minute update means 09:45. Commit to an update, not an unverified restoration deadline.”
Why it works: The team can control the next communication even while repair timing is uncertain.
Step 4: Revise when the evidence changes
At 09:45, 3 sites remain affected, 35 are working and 2 are unchecked. Three of the original six affected sites have recovered; there are no newly confirmed affected sites.
What would you do here? Open the move you’d make.
Update all three counts and keep the cause open.
The strong move. Verified working sites and recovery among affected sites use different denominators.
Say 87.5% of affected sites recovered.
Tempting, but it misses something. 35/40 is the working-site share, not the recovery rate.
See how a strong candidate says it
“At 09:45, three sites remain affected, 35 are working and two are unchecked. Three of six known affected sites recovered: 50%, not 87.5%.”
Why it works: Verified working sites and recovery among affected sites use different denominators.
The answer, in short
- Decision
- Publish confirmed impact, the open question and the next update time.
- Because
- The first statement can be useful without guessing the cause.
- What would change it
- At 09:55 all 40 sites pass a check. Report that time-bounded result while the cause remains under investigation.
At 09:55 all sites pass a check. Can you now say the incident never affected service?
Common traps
- Treating an AI draft as evidence.
- Confusing a current snapshot with incident history.
Check your answer
- I separated checked and unchecked sites.
- I kept the cause unresolved.
- I gave an update time.
- I revised the correct denominator.
Last reviewed Nov 10, 2026