Free facilitator kit
Tabletop Exercise Scenarios for Cybersecurity
Everything you need to run a 90-minute tabletop exercise with your leadership and response team, without hiring someone to write the scenario. Pick one of four realistic scenarios, swap in your own systems and vendors, and hand out the injects one at a time. The kit includes the agenda, ground rules, facilitator tips, and a scorecard that turns the discussion into owned action items.
What's inside
- A minute-by-minute 90-minute agenda, role descriptions, ground rules to read aloud, and facilitator tips
- Four scenarios: ransomware with data extortion, business email compromise wire fraud, cloud credential leak with exposed storage, and AI agent prompt-injection data leak
- Three to four timed injects per scenario, each with discussion questions and the decisions a prepared team should reach
- An after-action scorecard with 15 scored areas, strengths and gaps, and an action item tracker
Running the exercise
- 90-minute agenda
- Roles: facilitator, scribe, participants, observers
- Ground rules and facilitator tips
Scenarios
- Ransomware with data extortion
- Business email compromise and wire fraud
- Cloud credential leak and exposed storage
- AI agent prompt injection and data leak
Afterwards
- After-action scorecard with 15 areas
- Strengths, gaps and owned action items
Get the Word document
Enter your work email and the download unlocks right here. No drip sequence.
Frequently asked questions
What is a tabletop exercise?
A discussion-based rehearsal of a security incident. The team talks through how it would respond as a facilitator reveals the scenario step by step. Nothing is touched in production; the point is to find gaps in plans, roles and decisions before a real incident does.
Who should take part?
The people who would make decisions in a real incident: IT and security leads, an executive sponsor, legal or compliance, communications, and finance for anything involving payments. Keep it to about six to twelve people.
How often should we run one?
At least once a year, and whenever your team, systems or insurer change. Rotate scenarios so you test different parts of the plan.