Instant Message feed items let participants have live, two-way conversations with AI-powered actors — uncovering information, negotiating, and making decisions under realistic pressure.
What are Instant Message feed items?
Instant Message items add AI-powered actors to the Dynamic Feed that participants can chat with directly — people like a security team member investigating the incident, a ransomware group representative demanding payment, or a journalist asking for comment. The conversation is fully two-way: participants ask questions, push back, negotiate, and interpret what they're told.
Rather than presenting all the facts upfront, these actors make participants work for information. That's the point. Asking the right questions, reading between the lines, and making decisions without complete certainty — that's what happens in real incidents. Instant Message feed items bring that pressure into the simulation.
Configuring an Instant Message (AI Chat)
Add an Instant Message item to the feed to get started. The default configuration looks like this:
Sender name
The name of the simulated actor who opens the chat with the participant. Use a realistic name that fits the persona — for example, "Phil Carter" for an internal IT contact, or leave it deliberately ambiguous for a threat actor.
Prompt
This is the core field. It defines who the AI actor is, what they know, and how they behave. See Building your first interactable AI below for guidance on writing effective prompts.
AI First Message
Every Instant Message conversation starts with a message from the AI actor. Set that opening message here to establish tone and context straight away. Examples:
- "Hey, have you seen the news?"
- "Hi, Phil from the Security Team here — do you need any information on the breach investigation?"
Deliver after X seconds
Sets the delay before the conversation opens and the first message arrives. Set it to 0 to deliver immediately when the participant reaches the inject. Delivery time can be set in multiples of 10.
Building your first interactable AI
The Prompt field is where you define your AI actor. A well-written prompt produces a character who responds consistently, paces information naturally, and creates genuine decision pressure. A vague one produces generic, unhelpful responses that undermine the simulation.
AI actors work best when they're configured as people with roles, not as incident summaries. The prompt should tell the AI who it is — not just what happened.
Configure actor prompts in the Prompt box on the Instant Message configuration page:
Compare these two approaches:
Poor example prompt:
"Customer data was leaked after a misconfigured cloud storage bucket."
This describes what happened, not who the actor is or how they should behave.
Better example (defines an actor):
"You are a cloud security engineer who discovered customer data exposed via a misconfigured storage bucket."
The second version gives the AI an identity, a perspective, and a reason to interact meaningfully with participants.
If the prompt reads like an incident report, it's probably not a good actor prompt.
Recommended prompt structure
A good AI actor prompt covers four or five short elements. You don't need long or complex prompts — clarity matters more than length.
- Who they are (role, seniority, internal or external)
- What they know (specific information they can reveal if asked)
- What they're trying to achieve (help, pressure, negotiate, inform, investigate)
- How they behave (tone, attitude, level of openness)
- Specific information they hold that participants can surface to inform their decisions
Example actor prompts
The examples below show how well-written prompts produce actors who interact persistently and realistically — giving participants the kind of information that shapes decisions without making it too easy.
Internal Security Team Actor
Why this works well in Crisis Sim:
- Participants must ask good questions to uncover facts
- Information is paced naturally, like a real incident bridge
- Unknowns create decision pressure rather than frustration
- Short responses encourage back-and-forth rather than monologues
External Threat Actor
Why this works well in Crisis Sim:
- Participants must negotiate, probe, and challenge claims to uncover meaningful details
- Information is revealed strategically, reflecting real attacker communication and power dynamics
- Partial disclosure and hints create pressure without making outcomes feel scripted
- Short, controlled responses reinforce realism and force deliberate, high-quality interaction
Other ideas for AI actors
Internal security teams and threat actors are common starting points, but you can use AI actors to represent any stakeholder who'd plausibly contact someone during a real incident:
- Executive leadership — to test decision-making, risk tolerance, and communication under pressure
- Legal or compliance teams — to explore regulatory obligations and disclosure timing
- Customers or partners — to surface trust, impact, and contractual concerns
- Regulators — to introduce reporting deadlines and external scrutiny
- IT operations teams — to provide insight into system availability, recovery, and constraints
Each actor should hold specific, role-appropriate information that participants can surface through conversation. That's what makes the interaction feel real and keeps decision-making meaningful throughout the simulation.