TTX-01Intermediate
Double-extortion ransomware
Hypervisors encrypted on a Friday night, data on a leak site, and a ransom demand on the table.
- Duration
- 3 h
- Injects
- 9
- Audience
- Technical · Executive · Legal & privacy
T1486T1490T1567Open scenario
14 × TTX
Scenario library
Ready-to-run exercises. Each scenario includes objectives, a starting situation, a timed inject list, discussion questions, facilitator notes and evaluation criteria.
Run a live tabletop exerciseTTX-02Foundational
Business email compromise
A supplier's “new bank details” and a wire that already left. Can finance and IT claw it back?
- Duration
- 2 h
- Injects
- 8
- Audience
- Finance · Technical · Executive
T1566T1114T1564.008Open scenario
TTX-03Intermediate
Cloud access key leak
A long-lived key pushed to a public repo, a billing spike and storage buckets being listed.
- Duration
- 2.5 h
- Injects
- 8
- Audience
- Cloud & DevOps · Technical
T1552.001T1496T1530Open scenario
TTX-04Intermediate
Departing insider
A privileged engineer resigns and gigabytes flow to personal cloud storage. HR, legal and security must act together.
- Duration
- 2 h
- Injects
- 8
- Audience
- HR · Legal & privacy · Technical
T1567.002T1213T1078Open scenario
TTX-05Advanced
Software supply-chain compromise
A trusted vendor's signed update was trojanized, and it is installed on hundreds of your machines.
- Duration
- 3 h
- Injects
- 9
- Audience
- Technical · Executive · Communications
T1195.002T1071T1078Open scenario
TTX-06Foundational
DDoS during peak season
Your storefront and API buckle under a multi-vector flood, then an extortion email arrives.
- Duration
- 2 h
- Injects
- 8
- Audience
- IT operations · Communications · Executive
T1498T1499Open scenario
TTX-07Advanced
Data breach & regulatory notification
Customer PII confirmed exfiltrated. GDPR, NIS2 and SEC clocks start ticking in parallel.
- Duration
- 3 h
- Injects
- 9
- Audience
- Legal & privacy · Executive · Communications
T1190T1041Open scenario
TTX-08Foundational
Phishing and session hijacking
A convincing login page beats MFA, a mailbox rule hides the evidence, and the next phish comes from inside.
- Duration
- 2 h
- Injects
- 8
- Audience
- Technical · Finance · Communications
T1566.002T1557T1114.003Open scenario
TTX-09Intermediate
Third-party vendor breach
Your file-transfer provider was mass-exploited. Your customers' data sat on its servers, and you learn it from the news.
- Duration
- 2.5 h
- Injects
- 8
- Audience
- Legal & privacy · Executive · Technical
T1190T1199T1567Open scenario
TTX-10Foundational
Deepfake executive fraud
The CFO joins a video call with the CEO who urgently needs a transfer. Except the CEO was never on the call.
- Duration
- 2 h
- Injects
- 8
- Audience
- Finance · Executive · Communications
T1566.004T1656T1585Open scenario
TTX-11Advanced
Identity provider takeover
MFA fatigue hands an attacker a super-admin account in your SSO. Every app you own now trusts them.
- Duration
- 3 h
- Injects
- 9
- Audience
- Technical · Cloud & DevOps · Executive
T1621T1484.002T1078.004Open scenario
TTX-12Foundational
Lost unencrypted laptop
A laptop disappears from a car overnight. Nobody is sure what was on it, or whether it was encrypted.
- Duration
- 1.5 h
- Injects
- 7
- Audience
- Legal & privacy · HR · Technical
T1005Open scenario
TTX-13Advanced
Hospital ransomware and diversion
The EHR is down, ambulances may need diverting and paper downtime procedures haven't been drilled in years.
- Duration
- 3 h
- Injects
- 9
- Audience
- Executive · IT operations · Legal & privacy
T1486T1490T1489Open scenario
TTX-14Advanced
OT / ICS plant intrusion
Ransomware is spreading in IT and an HMI starts behaving oddly. Do you stop the line before safety is at stake?
- Duration
- 3 h
- Injects
- 9
- Audience
- IT operations · Technical · Executive
T0886T0831T0816Open scenario
Compare scenarios
| Scenario | Difficulty | Duration | Injects | Audience | ATT&CK | Run live |
|---|---|---|---|---|---|---|
| TTX-01Double-extortion ransomware | Intermediate | 3 h | 9 | Technical, Executive, Legal & privacy | T1486 T1490 T1567 | Run live |
| TTX-02Business email compromise | Foundational | 2 h | 8 | Finance, Technical, Executive | T1566 T1114 T1564.008 | Run live |
| TTX-03Cloud access key leak | Intermediate | 2.5 h | 8 | Cloud & DevOps, Technical | T1552.001 T1496 T1530 | Run live |
| TTX-04Departing insider | Intermediate | 2 h | 8 | HR, Legal & privacy, Technical | T1567.002 T1213 T1078 | Run live |
| TTX-05Software supply-chain compromise | Advanced | 3 h | 9 | Technical, Executive, Communications | T1195.002 T1071 T1078 | Run live |
| TTX-06DDoS during peak season | Foundational | 2 h | 8 | IT operations, Communications, Executive | T1498 T1499 | Run live |
| TTX-07Data breach & regulatory notification | Advanced | 3 h | 9 | Legal & privacy, Executive, Communications | T1190 T1041 | Run live |
| TTX-08Phishing and session hijacking | Foundational | 2 h | 8 | Technical, Finance, Communications | T1566.002 T1557 T1114.003 | Run live |
| TTX-09Third-party vendor breach | Intermediate | 2.5 h | 8 | Legal & privacy, Executive, Technical | T1190 T1199 T1567 | Run live |
| TTX-10Deepfake executive fraud | Foundational | 2 h | 8 | Finance, Executive, Communications | T1566.004 T1656 T1585 | Run live |
| TTX-11Identity provider takeover | Advanced | 3 h | 9 | Technical, Cloud & DevOps, Executive | T1621 T1484.002 T1078.004 | Run live |
| TTX-12Lost unencrypted laptop | Foundational | 1.5 h | 7 | Legal & privacy, HR, Technical | T1005 | Run live |
| TTX-13Hospital ransomware and diversion | Advanced | 3 h | 9 | Executive, IT operations, Legal & privacy | T1486 T1490 T1489 | Run live |
| TTX-14OT / ICS plant intrusion | Advanced | 3 h | 9 | IT operations, Technical, Executive | T0886 T0831 T0816 | Run live |