Facilitator Guide

For whoever is running the room. Read this once before you teach it.

Prep checklist (the day before)

Re-verify the frontier facts. Open the Sources page and confirm the Mythos / Autonomous SOC numbers haven’t moved. This subject ages in weeks.
Pick your Block 2 case study — one recent, well-documented breach you can walk through the kill chain. Have it open in a tab.
Dry-run the deck in the browser you’ll present from. Test full-screen and the speaker view (S in reveal.js).
Set up the workshop target repo. Fork the vulnerable demo repo yourself first so you have a known-good reference run.
Confirm Trinetra access for participants (or have a shared demo account / projected walkthrough as a fallback).
Decide the format: pure lecture, or interactive with polls and discussion. The Mythos discussion prompt works best with a live show of hands.

The two failure modes are (1) over-running Block 1 so the workshop gets squeezed, and (2) letting the Mythos discussion sprawl. Guard both:

Block 1 is foundations, not a deep dive — keep crypto conceptual. If you’re behind at the first break, trim network internals, not the workshop.
The Mythos discussion is 5 minutes, hard stop. It’s a hook, not the destination.
Protect the workshop. It’s the part people remember. If something has to give, cut lecture detail, never the hands-on time.

Foundations: keep energy up — this is the “eat your vegetables” block. Use the risk = likelihood × impact framing early; you’ll call back to it all class.
Threat landscape: the case study is your engagement engine. Make it a story.
Mythos: teach the alarm and the counter-narrative. If you only do doom, you lose the skeptics in the room; if you only do “hype,” you understate a real shift. Hold both.
Autonomous SOC: the “you can’t staff your way out of 4,000 alerts/day” line lands the why. Emphasize the analyst is promoted, not replaced.
Post-Mythos: slow down. The five-things slide is the one people photograph.
Workshop: circulate. The learning is in the triage reasoning, not the tool clicks.

If…	Then…
Trinetra access fails for participants	Run it projected as a guided demo; participants do triage reasoning on your screen
You’re 15+ min behind at the second break	Compress Post-Mythos to just the five-things slide; protect workshop time
Room is expert-heavy	Spend less on Foundations, more on the Mythos counter-narrative and agent-security discussion
Room is beginner-heavy	Add 5 min to Foundations, simplify the SOC tooling acronyms, slow the lab

Slides: Run the Deck — runs in-browser, embedded.
Speaker notes: the lecture pages mirror the deck and carry the talking points.
Participant handout: point them at the workshop pages and the Glossary.