Guides · 8 min read
Cybersecurity Tabletop Exercise Scenarios That Hold Up Under Pressure
The scenario is not the exercise. What matters is which decision it forces and how quickly the room runs out of comfortable options. These are the scenarios that reliably do that, and the pressure point inside each one.
Pick the scenario by the decision you want tested
| Scenario | The decision it forces | Best for |
|---|---|---|
| Ransomware in a core file share | Keep trading or take systems offline | Executive teams, first exercise |
| Business email compromise | Recall funds, notify the bank, tell the customer | Finance-heavy organisations |
| Third-party / supplier breach | How much do you trust a vendor's statement | MSPs, manufacturers, retail |
| Insider data exfiltration | HR, Legal and Security acting together | Mature teams |
| Cloud identity compromise | Revoke access vs preserve evidence | SaaS and cloud-native |
| OT/ICS intrusion | Cut the IT/OT link and stop the line | Manufacturing, utilities |
| Leak-site extortion without encryption | Public posture with no downtime | Comms and Legal |
| DDoS with extortion note | Absorb, mitigate, or negotiate | E-commerce, gaming, fintech |
Ransomware: the default first exercise, for good reason
Ransomware is the scenario every executive already has an opinion about, which makes it the fastest way to expose where those opinions conflict. The value is not the encryption — it is the trading decision, the backup integrity question nobody can answer, and the moment Legal and Comms discover they are working from different facts.
- Inject that bites: the EDR timeline showing a service account authenticating from an unmanaged host 41 minutes before the first encrypted file.
- Inject that bites harder: a customer forwards your data on a leak site before you have confirmed exfiltration.
Business email compromise: the quietest expensive incident
No malware, no alerts, no dramatic dashboard — just a payment that went to the wrong account and a 24-hour window to recall it. BEC exercises test process discipline rather than technical response, which is why finance and executive teams tend to fail them.
OT/ICS: where the incident stops being an IT decision
When the historian stops writing and HMIs show stale values, the question moves from the SOC to the plant manager. Run this one with operations leadership in the room or it becomes theatre.
Tailor before you run
A generic scenario gets generic answers. The same ransomware inject should read differently for an MSP with 40 tenants, a hospital with PACS in scope, and a SaaS company with no file share at all. Rewriting injects around the client's actual environment is the difference between a plausible exercise and a memorable one.
Frequently asked questions
- How many injects does a 90-minute exercise need?
- Eight to twelve. Fewer and the room stalls; more and you are reading rather than facilitating.
- Should we tell participants the scenario in advance?
- Tell them the theme and the time commitment, never the injects. Executives need to prepare their diary, not their answers.
Run this exercise in TableTop Sim
The scenario library, the facilitator control room and the after-action report — included in the free trial.