A network of hosts surrounds a central server core. Trigger a simulated compromise, then compare two response paths: manual triage, where a human analyst must notice, investigate, decide and finally execute an isolation action across four sequential stages with randomized realistic delays, versus an automated SOAR playbook that isolates the host within a second of detection with no human decision-latency in the loop. Damage compounds exponentially the whole time the host stays connected, so the response path chosen determines the final cost by orders of magnitude — watch the live chart and the host-by-host lateral spread on the network to see why.