01
Ransomware with Data Extortion
Attackers encrypt file servers and threaten to publish stolen data unless a ransom is paid.
Best for: All industries
Length: 90 to 120 minutes
Free Kit
Rehearse the worst day before it happens.
A tabletop exercise (TTX) is a discussion-based rehearsal of a cyber incident. Your leadership team walks through a realistic scenario, makes decisions, and finds gaps in plans, contacts, and authority while the stakes are low. Cyber insurers, auditors, and regulators increasingly expect to see one.
Download
Get the complete kit or just what you need.
Complete Tabletop Exercise KitFacilitator guide, twelve role descriptions, role scaling by company size, an exercise log, eight scenarios with injects and discussion questions, and an after-action report template.Download PDF (135 KB) ↓
Facilitator Guide & After-Action ReportHow to plan, run, and document an exercise, with ground rules, roles for any company size, a scenario menu, an exercise log, and a fill-in report.Download PDF (93 KB) ↓
Free to use and adapt for your organization's internal exercises. Scenarios are fictional; legal and regulatory references are general information, not legal advice.
How It Works
Five steps to a useful tabletop exercise.
1. Plan
Pick a scenario that matches your top risks, set two to four objectives, and invite the decision-makers. Allow 90 to 120 minutes.
2. Brief
Read the ground rules: no fault, no gotchas, and answer with the resources you really have today.
3. Play
Read each inject, then discuss. Push for specifics: who decides, how fast, and with what information.
4. Debrief (“hotwash”)
Capture what went well, what was unclear, and three to five action items with owners and due dates. The scribe reads back the exercise log.
5. Document and improve
File the exercise log, complete the after-action report, update your incident response plan, and schedule the next exercise. Aim for at least one per year.
Roles
Who should be in the room.
In a small business one person often holds several roles. Assign each one before the exercise and name a backup for every decision-maker. The kit includes the questions each role should be ready to answer.
| Role | Responsibilities during an incident |
|---|---|
| Facilitator | Runs the exercise. Keeps time, reads injects, asks follow-up questions, and keeps the discussion blame-free. |
| Scribe / Observer | Records decisions, gaps, assumptions, and action items. Does not participate in the discussion. |
| Executive Sponsor (CEO / Owner) | Sets priorities, approves major decisions (shutting down systems, paying, notifying), and speaks for the company. |
| Incident Commander | Coordinates the response, assigns tasks, tracks status, and runs regular update calls. Often the virtual chief information security officer (vCISO) or IT/security lead. |
| information technology (IT) Lead / Managed Service Provider (MSP) | Investigates, contains, and restores systems. Preserves evidence and logs. |
| Security Lead / vCISO | Assesses scope and severity, guides containment and forensics, and maps actions to the incident response plan. |
| Legal / Privacy Counsel | Advises on privilege, regulatory and contractual notification duties, law enforcement contact, and payment legality. |
| Communications / Public Relations | Prepares internal, customer, partner, media, and regulator messaging. Controls a single source of truth. |
| Finance / chief financial officer (CFO) | Manages payments, banking contacts, insurance claims, and emergency spending authority. |
| Human Resources | Handles employee communications, insider issues, payroll continuity, and staff well-being during a long incident. |
| Operations / Business Continuity | Keeps the business serving customers using manual workarounds while systems are restored. |
| Cyber Insurance / Broker Liaison | Notifies the carrier promptly and coordinates approved vendors (breach coach, forensics, negotiators). |
Document It
Keep an exercise log, so the next exercise starts where this one ended.
The most valuable output of a tabletop is the written record. Name a scribe before you start, log every event and decision as it happens, and file the log and after-action report with your incident response plan. Insurers, auditors, and customers increasingly ask for this evidence.
What to record
- Date, scenario, participants, and their roles
- Each event (inject), the time it was introduced, and what the team decided
- Who owned each decision and how long it took
- Missing information, contacts, tools, or authority
- Action items with an owner and a due date
How to use it next time
- Open the next exercise by reviewing last time's action items
- Re-test the gaps you found, or pick a harder scenario
- Track improvement: faster decisions, fewer unknowns
- Update your incident response plan and contact list
- Keep logs for at least the life of your insurance policy and contracts
The Facilitator Guide includes a printable exercise log and after-action report template.
Any Size
Scale the roles to your company.
You do not need twelve people. Every scenario works with combined roles, as long as you name a facilitator, a scribe, and one decision-maker.
| Company size | Who should attend | How roles combine |
|---|---|---|
| Micro (1 to 10 people) | Owner, office manager, IT provider; insurance broker or attorney by phone | Owner leads and decides; IT provider covers technology and security; a trusted outsider facilitates; the office manager keeps the log. |
| Small (10 to 50 people) | Owner or CEO, operations lead, finance, IT lead or managed service provider, HR or office manager | Operations lead runs the response; finance also handles insurance; HR also handles communications. |
| Mid-sized (50 to 500 people) | Executive team, IT and security leads, legal, communications, HR, finance, operations | Assign each role to one person with a named backup, and consider a separate technical tabletop for the IT team. |
Scenarios
Eight ready-to-run scenarios.
An inject is a new piece of the story the facilitator reads aloud, such as “the bank calls” or “a reporter emails.” The hotwash is the short debrief at the end. Each scenario includes objectives, recommended participants, timed injects, discussion questions by role, key decisions to look for, and the related National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0 functions.
02
Business Email Compromise and Wire Fraud
A vendor's email account is compromised and used to redirect a large payment to a fraudulent bank account.
Best for: Finance, professional services, real estate, any business that sends payments
Length: 60 to 90 minutes
03
Deepfake Executive Voice and Video Fraud
An employee joins a video call with what appears to be the CEO and CFO, who instruct a confidential urgent transfer.
Best for: All industries, especially those with public-facing executives
Length: 60 minutes
04
Cloud Account Takeover and Data Exposure (Microsoft 365 or Google Workspace)
An administrator account is compromised through an MFA-fatigue attack, and sensitive files are shared externally.
Best for: Any business using cloud email and file sharing
Length: 75 minutes
05
Shadow AI Data Leak and AI Agent Misuse
Confidential client data is pasted into an unapproved artificial intelligence (AI) tool, and an AI agent with broad permissions sends sensitive files externally.
Best for: Any business adopting AI tools
Length: 60 to 75 minutes
06
Third-Party and MSP Compromise
Your managed service provider's remote management tool is compromised and used to push malware to its clients.
Best for: Any business that relies on an MSP or key software vendor
Length: 75 minutes
07
Healthcare: EHR Outage and PHI Breach
A ransomware attack takes the practice's electronic health record (EHR) offline, and patient records may have been taken.
Best for: Medical, dental, behavioral health, and other HIPAA-covered practices
Length: 90 minutes
08
Defense Supplier: CUI Exposure and DFARS Reporting
A defense supplier discovers that an engineering file share containing CUI was accessed by an unknown actor.
Best for: Defense and aerospace suppliers handling controlled unclassified information (CUI)
Length: 75 minutes
Games & Card Decks
Security games and card decks that make practice fun.
Card and board games are a low-pressure way to build incident response and threat-modeling skills across technical and non-technical teams.
Backdoors & BreachesBlack Hills Information Security's incident response card game; one of the most popular ways to run a quick, low-prep tabletop. Free online version available.Visit ↗
Oh Noes!Expel's free, printable incident response tabletop role-playing game.Visit ↗
Malware & MonstersA role-playing approach to incident response training and tabletops.Visit ↗
Decisions & DisruptionsA research-based game from academic security researchers where leaders allocate a security budget and face the consequences.Visit ↗
RiskioA cyber risk awareness game built for non-technical staff.Visit ↗
OWASP CornucopiaOpen Worldwide Application Security Project (OWASP) card game for threat modeling web and mobile applications.Visit ↗
Elevation of PrivilegeAdam Shostack's threat modeling card game, originally released by Microsoft. Free to download.Visit ↗
The Security CardsUniversity of Washington brainstorming deck for thinking like an attacker.Visit ↗
Exploited in the WildA card game built around real-world exploited vulnerabilities, originally created by Wiz.Visit ↗
Shostack + Associates games directoryA long, curated list of security tabletop games and card decks.Visit ↗
Awesome Security Card GamesA community-maintained GitHub list of security card and board games.Visit ↗
Links are provided for convenience. Nexus Security Advisors is not affiliated with these publishers.
Free Government Packages
More free exercise material from government agencies.
CISA Tabletop Exercise Packages (CTEPs)Free Cybersecurity and Infrastructure Security Agency (CISA) exercise packages covering ransomware, insider threats, elections, and more.Visit ↗
NCSC Exercise in a BoxThe UK National Cyber Security Centre's free online exercise tool for small organizations.Visit ↗
Exercise in a Box (Australia)The Australian government's free version of the Exercise in a Box format.Visit ↗
Direct downloads: CISA Tabletop Exercise Package documents
These free planning documents come straight from the Cybersecurity and Infrastructure Security Agency (CISA). Scenario packages are listed on the CISA CTEP documents page.
- CTEP Welcome Letter (PDF) ↗
- Exercise Planner Handbook (PDF) ↗
- Facilitator and Evaluator Handbook (PDF) ↗
- Invitation Letter Template (PDF) ↗
- Exercise Brief Slide Deck Template (PDF) ↗
- Participant Feedback Template (PDF) ↗
- Planner Feedback Form (PDF) ↗
- After-Action Report and Improvement Plan Template (PDF) ↗
Facilitated Exercises
Want an independent facilitator?
Nexus Security Advisors designs custom tabletop exercises around your industry, systems, insurance policy, and regulators, facilitates them for your leadership team, and delivers a written after-action report with a prioritized improvement plan. Scenarios include ransomware, business email compromise, deepfake fraud, AI misuse, cloud account takeover, and regulatory-reporting drills.