Incident Response Tabletop
A branching ransomware scenario. Make the containment and communication calls a real incident commander has to make under pressure.
A branching ransomware scenario where you make the containment and communication calls under time pressure. The technical decisions turn out to be the easy ones.
How to use it
- Assess the initial report.
- Make containment decisions and live with the consequences.
- Handle communication — internal, customer, regulatory.
What to take away
Containment destroys evidence
Pulling a machine off the network stops the spread and ends your ability to see what happened. Both matter; you have to choose knowingly.
Communication failures outlast technical ones
Organisations recover from the outage. They do not recover as easily from having misled customers or missed a notification deadline.
Decide the ransom position in advance
Mid-incident is the worst possible time to first consider it, and there may be sanctions implications that need legal input, not engineering input.
Frequently asked questions
What is a tabletop exercise?
A discussion-based rehearsal where the team talks through a scenario and makes decisions without touching production. It finds gaps in process and authority cheaply.
Who should be in the room?
Not just security. Legal, communications, an executive who can authorise spending, and whoever actually owns the affected systems. Most gaps found are between teams, not inside them.
Where this fits in the course
This security lab pairs with Path 16 — Advanced — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Log Analysis / IR Lab — A messy auth.log dump from a compromised box. Reconstruct the timeline and find the breach — blue-team skills, not exploitation.
- Incident Severity & SLA Calculator — Impact × urgency in, a priority tier and realistic remediation SLA out.
- Vendor Risk Tiering Simulator — Six vendors, six very different data-access levels. Tier them correctly and decide who needs a full security review.
- Risk Register Builder — Add risks with likelihood and impact, get an auto-scored severity, and export the register as Markdown.