Every CISO knows the theory: test your incident response plans regularly, exercise your teams, validate your playbooks. But when it comes to actually designing a tabletop exercise, many security leaders struggle with the same question: what scenarios should we run?
The answer depends on your threat landscape, but certain scenarios are universal enough that every security organization should exercise them at least once a year. The five scenarios below are drawn from real-world incidents and regulatory expectations (NIST CSF, ISO 27001, DORA, NIS2). For each, we provide a scenario description, recommended injects, measurable success criteria, and the key lessons you should be looking to capture.
These are not theoretical abstractions. Each scenario is designed to be run as a half-day tabletop exercise with 10-30 participants across security, IT operations, legal, communications, and executive leadership.
Ransomware remains the most impactful cyber threat facing organizations. This scenario tests the full spectrum of response: technical containment, executive decision-making on ransom payment, regulatory notification, business continuity during system outages, and public communications.
On a Friday afternoon, the SOC detects anomalous file encryption activity across multiple file servers. Within 30 minutes, ransom notes appear on affected systems. The threat actor claims to have exfiltrated 200GB of data before deploying encryption. Backups for two critical systems are found to be corrupted. The ransom demand is $2M in cryptocurrency with a 72-hour deadline.
SOC Alert: Anomalous Encryption Activity
Multiple endpoints reporting rapid file modification. AV signatures not matching. What is the immediate containment action?
Ransom Note Discovery
Ransom demand received with proof-of-exfiltration. Threat actor provides sample of stolen data. Who makes the decision on engaging with the threat actor?
Backup Integrity Check Failure
IT reports that backups for ERP and CRM systems are corrupted. Recovery time estimate is 5-7 days for clean rebuild. What are the manual business continuity options?
Media Inquiry and Regulatory Pressure
A journalist contacts PR about "a major data breach." The data protection authority expects notification within 72 hours. How do you coordinate external communications?
Ransom Deadline Approaching
48 hours in. Systems still down. Threat actor publishes a small sample of data. Board wants an update. What is the executive decision framework for the ransom?
Data breach notification is one of the most legally and operationally complex response activities. This scenario specifically tests the notification workflow mandated by GDPR (Articles 33 and 34), but the principles apply to any privacy regulation: CCPA, PIPEDA, LGPD, or sector-specific rules like HIPAA.
A routine security audit reveals that a web application vulnerability (SQL injection in a legacy customer portal) has been exploited. Log analysis shows unauthorized access to a database containing 150,000 customer records including names, email addresses, phone numbers, and hashed passwords. The vulnerability has been present for approximately 6 weeks. The attacker's IP traces to a known bulletproof hosting provider.
Vulnerability Discovery and Scope Assessment
Security team confirms SQLi exploitation. Initial scope: 150K records. What is the forensic preservation plan? Who leads the investigation?
Legal Analysis: Notification Obligations
Affected customers span three jurisdictions (EU, UK, US). Legal must determine: which regulators to notify, within what timeframes, and whether individual notification is required.
Scope Escalation
Deeper forensic analysis reveals that the attacker also accessed a table containing partial payment card data (last 4 digits, expiry dates). Does this change the notification requirements?
Customer Communication Drafting
Draft the notification email to affected customers. What information should be included? What remedial actions should be offered (credit monitoring, password reset)?
Media Coverage and Customer Support Surge
News article published. Customer support volume triples. Social media criticism is escalating. How do you manage the response while the investigation continues?
Supply chain attacks have become a top-tier threat, as demonstrated by incidents like SolarWinds, Kaseya, and the 3CX compromise. This scenario tests your organization's ability to respond when a trusted vendor or software component is compromised, and you must determine your exposure while managing the uncertainty.
A critical SaaS vendor used for identity and access management (IAM) issues an emergency advisory: their build pipeline was compromised, and a malicious update was pushed to customers over the past 10 days. The advisory is vague on technical details. Your organization deployed the affected update 8 days ago. The vendor cannot yet confirm what data may have been accessed through their platform.
Vendor Advisory Received
Vague advisory from IAM vendor. Confirmed compromised update. What is the immediate response? Do you isolate the affected systems? What is the blast radius assessment process?
Internal Threat Hunting
IOCs are released by the vendor. Your threat hunting team finds matching indicators in DNS logs. What is the escalation path? How do you determine whether the attacker moved laterally from the IAM platform?
Vendor Communication Breakdown
The vendor stops providing updates for 12 hours. Rumors circulate on social media that the breach is worse than disclosed. Your board asks: should we cut ties with this vendor? What is the short-term and long-term plan?
Customer Impact Assessment
If the IAM vendor handled authentication for your customer-facing applications, your own customers may be affected. What is your obligation to them? Do you notify preemptively or wait for confirmed impact?
Insider threats are uniquely challenging because they involve people the organization trusts, using legitimate access. This scenario tests the intersection of security, HR, legal, and management -- a coordination challenge that purely technical exercises miss entirely.
A DLP (Data Loss Prevention) alert fires: a senior engineer in the R&D department has uploaded 3GB of proprietary source code and product roadmap documents to a personal cloud storage account over the past two weeks. HR confirms the engineer recently gave notice and is leaving for a competitor. The engineer's manager was unaware of the data transfers.
DLP Alert and Initial Assessment
DLP system flags bulk upload to personal cloud storage. How do you verify the alert without tipping off the individual? What evidence do you need to preserve?
HR-Security Coordination
The engineer is in their notice period with 10 days remaining. What is the coordination protocol between security, HR, legal, and the engineer's management? When and how do you restrict access?
Scope Discovery: Additional Exfiltration Channels
Investigation reveals the engineer also emailed files to a personal address and used a USB drive. The scope is larger than initially thought. What is the trade secret protection strategy?
Legal Escalation and Remediation
Legal wants to pursue civil action and potentially involve law enforcement. What evidence chain is required? How do you balance investigation with the employee's rights? What preventive controls need strengthening?
Cloud infrastructure failures test operational resilience in ways that security-focused exercises often overlook. This scenario exercises the intersection of cloud operations, business continuity, vendor management, and crisis communications when the technology you depend on simply stops working.
Your primary cloud provider experiences a major regional outage affecting compute, storage, and managed database services. The outage begins at 9:00 AM on a business day. The provider's status page acknowledges "degraded performance" but provides no ETA for resolution. Your customer-facing applications, internal tools, and CI/CD pipeline all run in the affected region. Multi-region failover was designed but never tested under real conditions.
Initial Outage Detection
Monitoring alerts fire for all services in the affected region. Provider status page says "investigating." What is the impact assessment process? How quickly can you determine which customer-facing services are down?
Failover Decision Point
Two hours in. No resolution ETA. Do you trigger multi-region failover? The failover procedure has never been tested in production. What is the risk of a failed failover vs. continued downtime?
Customer Communication and SLA Impact
Enterprise customers are requesting status updates. SLA clocks are running. What do you tell customers when you do not know the root cause? How do you manage SLA credit calculations?
Data Integrity Concerns
When the region comes back, database consistency checks reveal potential data loss for transactions processed during the outage onset. How do you validate data integrity? What is the reconciliation process?
Post-Incident: Architecture Review Request
The CTO requests a plan to prevent this from happening again. What architectural changes are needed? What is the cost-benefit analysis of true multi-region active-active vs. warm standby?
These five scenarios cover the most critical threat categories that CISOs face: external cyberattacks (ransomware), regulatory obligations (data breach notification), third-party risk (supply chain compromise), human risk (insider threat), and operational resilience (cloud infrastructure failure). Running each of these as a tabletop exercise at least once provides a comprehensive baseline assessment of your organization's response readiness.
A few principles apply across all five scenarios:
If you are looking for a platform that supports structured inject delivery, real-time participant tracking, and automated after-action reporting for exercises like these, see how Scenarium works or request a demo.
Design, facilitate, and report on tabletop exercises with a platform built for exercise directors who take crisis readiness seriously.
We use essential cookies to make Scenarium work. With your permission, we also use optional cookies for preferences and analytics. You can change your choices anytime in Cookie Settings.
Learn more in our Cookie Policy and Privacy Policy.
Choose which optional cookies you want to allow. Essential cookies are always enabled.
You can update these settings anytime using the Cookie settings button.