Tabletop exercise examples

Free exercise: Monday ransomware

Hard · 90 minutes

Setup: At 7:40am the service desk gets three calls: files on the shared drive end in .lockd and a note asks for payment.

Injects

1. 08:30 — The backup server shows the same file names.
2. 10:00 — A journalist emails asking for comment.
3. 13:00 — The attacker says they have customer data and will publish it in 72 hours.

Discussion questions

• Who declares SEV1 and how?
• How do we know the backups are clean?
• Who talks to the insurer, and when?
• What do we tell customers today?

More exercises in the kit

• The CFO's urgent transfer (Medium, 60 min)
• Wrong attachment (Easy, 45 min)
• Cloud admin at 2am (Hard, 75 min)
• Supplier breach in the news (Medium, 60 min)
• The helpful AI agent (Medium, 60 min)

With a facilitator guide, an after-action report template and an exercise tracker.