Collection · 14 articles
Scenario library
Ready-to-run exercises. Each scenario includes objectives, a starting situation, a timed inject list, discussion questions, facilitator notes and evaluation criteria.
- Ransomware Tabletop Scenario: Double Extortion on a Friday
A ready-to-run ransomware tabletop exercise: encrypted hypervisors, a leak-site countdown and a ransom demand, with 9 timed injects and discussion questions.
- BEC Tabletop Exercise: The Supplier Bank-Detail Change
A ready-to-run BEC tabletop exercise: a compromised mailbox, a fraudulent supplier bank change and a wire already sent. 8 injects for finance, IT and leadership.
- Cloud Access Key Leak Tabletop: Public Repo to Billing Spike
A cloud security tabletop exercise: a long-lived access key pushed to a public repository, cryptomining, storage enumeration and a race to rotate. 8 injects.
- Insider Threat Tabletop: The Departing Privileged Engineer
An insider threat tabletop exercise: a privileged engineer resigns and copies data to personal cloud storage. 8 injects for HR, legal and security together.
- Supply-Chain Compromise Tabletop: A Trojanized Signed Update
A software supply-chain tabletop exercise: a trusted vendor's signed update contains a backdoor installed across your estate. 9 injects for technical and exec teams.
- DDoS Tabletop Exercise: Peak-Season Outage and Extortion
A DDoS tabletop exercise: a multi-vector flood takes down your storefront and API during peak season, then an extortion email arrives. 8 timed injects.
- Data Breach Notification Tabletop: Racing Regulatory Clocks
A breach notification tabletop exercise: confirmed exfiltration of customer data with GDPR, NIS2, SEC and HIPAA deadlines running in parallel. 9 injects.
- Phishing Tabletop Exercise: When MFA Isn't Enough
A ready-to-run phishing tabletop exercise: an adversary-in-the-middle kit steals finance sessions despite MFA. 8 timed injects, questions and a scoring rubric.
- Third-Party Breach Tabletop Exercise: The MFT Zero-Day
A third-party breach tabletop exercise: your file-transfer vendor is mass-exploited and you hear it from the news. 8 injects on scoping, contracts and notification.
- Deepfake Tabletop Exercise: The CEO Who Wasn't There
A deepfake tabletop exercise: a synthetic CEO on a video call pressures the CFO into an urgent wire, then a fake audio clip goes viral. 8 injects with a rubric.
- Identity Provider Compromise Tabletop: Losing Your SSO
An identity provider compromise tabletop: MFA fatigue and help-desk fraud hand an attacker SSO super-admin. 9 injects on federation, break-glass and cutting SSO.
- Lost Laptop Tabletop Exercise: Stolen from a Car Overnight
A lost laptop tabletop exercise: a stolen manager's device, unproven encryption, HR data and a surprise MDM check-in. 7 injects for legal, HR and IT.
- Healthcare Ransomware Tabletop Exercise: EHR Down at 2 a.m.
A healthcare ransomware tabletop exercise: EHR and imaging encrypted overnight, ambulance diversion, paper downtime and HIPAA decisions. 9 injects, 3 hours.
- OT Tabletop Exercise: Ransomware Reaches the Plant Floor
An OT tabletop exercise for manufacturers: IT ransomware, an HMI with unexplained setpoint changes and a safety-first shutdown decision. 9 injects, 3 hours.