This is a walkthrough for SEs who have not used the product, not a demo rehearsal. Part 0 is configuration: what is feeding the console and with what rights. Parts 1 to 6 follow the product's six pillars in order. Every flag asks you to find something in the console and explain how the product produced it. Chad marks as you go: 10 points for an answer that explains the mechanism, 5 for the right screen with no explanation, 0 if you left it. The answer that counts is the one that explains the mechanism, not the one that names the screen.
fortidemo.app.suridata.ai — the shared read-only demo tenant. Nothing you do can break it.
They go straight to Chad's marking screen under the name you signed in with. You can come back on another device with the same email and code.
Every flag has a Clue — which page, which filter — at no cost. Opening the Hint takes 3 points off that flag, and Chad can see you opened it. Show me the answer gives you the answer and the lesson straight away and locks the flag at 0. When Chad reveals at the end, every answer opens for free.
Nothing here asks you to save, revoke, connect or enable anything. Where a flag opens a connector card or an editor, read it and close it. Stop at every confirmation dialog.
Only you see this. Create a code for today's room, read it out, and select the event you are marking. Codes stop working when the event expires or you close it.
Only you see this. Pick a flag, read everyone's answer against the key, mark it. Scores update on their screens within a few seconds.
Live for everyone in this event.
| Name | Points | Marked | Awaiting | Hints | Gave up |
|---|
Before the room arrives. Sign in as facilitator, create an event code, write it on the board. Players sign in with name, email and the code. If someone's laptop dies they sign in again on anything with the same email and pick up where they were.
Seven parts, ninety minutes. About twelve minutes a part: eight to find, four for one person to explain the mechanism out loud, in their own words, without the console. Part 0 first, always; the rest only make sense once people know where the data comes from. Start clock for everyone puts the same countdown on every screen.
Scoring. 10 for an answer that explains how the product produced the result, 5 for the right screen with no explanation, 0 for nothing. A hint takes 3 off whatever you give (10 becomes 7, 5 becomes 2). Show me the answer is the player giving up that flag for 0 in exchange for the answer and the lesson now; the marking screen shows who did. Clues are free on purpose: they are the click path, and the point of the session is to learn where things live.
Mark by flag, not by person. The marking panel shows everyone's answer to one flag side by side against the key. Answers are hidden on every card until a player gives up on it or you press Reveal answers to everyone, which opens them all at no cost.
Answers drift. Parts 2, 4, 5 and 6 were verified in the live tenant between 22 and 28 September 2026; Part 0, Part 1's ShareFile and Revoke flags, the SaaS Graph flag and Part 3 between 16 and 19 October 2026. The ones marked approximately are the ones to re-check on the morning. If a file has moved, the click path in the clue still works, so the flag still runs.
If you only have forty-five minutes, run Parts 0, 1 and 5: where the data comes from, the two kinds of unsanctioned software, and what the product knows about a file. That is enough to run a first customer conversation without overclaiming.
Never click Save, Create Ticket, Revoke Access, Request Business Justification or Connect. Close every editor with Close → Confirm. The tenant is shared and read-only, and every flag that touches a build or an action stops at the confirmation.
Debrief prompt for the last part: ask each person to explain, without the console, how shadow SaaS attribution works and why the S3 connector's credential matters to a customer. Those two answers show who understands the product and who has memorised the clicks.