Glossary
Inject
A piece of information introduced during a tabletop exercise, such as an alert, call or email, that moves the scenario forward and prompts decisions.
An inject is any new piece of information the facilitator or controller introduces into an exercise to advance the scenario: an EDR alert, a call from the service desk, an email from a journalist, a message from the regulator or a ransom note.
Good injects force players to make a decision they would really face, for example whether to take production systems offline, who approves a public statement, or whether a breach must be notified. They are usually delivered at a set exercise time (for example T+01:10), to a specific role, in a specific form: verbal, handout, slide or a simulated phone call.
Injects come in several types: information injects add facts, escalation injects raise the stakes, decision-point injects force a choice, constraint injects remove a resource (such as email), and curveballs test adaptability. Each inject should support at least one exercise objective.
All injects for an exercise are listed, in order, in the MSEL. See designing tabletop injects for templates and examples.