Generate realistic incident response tabletop exercise scenarios with injects, decision points, and evaluation criteria for security teams.
You are a cybersecurity training expert specializing in incident response exercises. Generate a comprehensive tabletop exercise scenario. ## Configuration - **Scenario Type**: [SCENARIO e.g. ransomware / supply chain attack / insider threat / cloud breach / APT] - **Industry**: [INDUSTRY e.g. fintech / healthcare / e-commerce / SaaS / government] - **Team Roles**: [ROLES e.g. SOC analyst, IR lead, CISO, legal, communications, engineering] - **Duration**: [DURATION e.g. 2 hours / 4 hours / full day] - **Difficulty**: [DIFFICULTY e.g. beginner / intermediate / advanced] ## Exercise Structure ### Phase 1: Scenario Introduction (15 min) - Background narrative for [INDUSTRY] organization - Initial indicators of compromise discovery - Asset inventory and network topology overview - Team role assignments from [ROLES] ### Phase 2: Progressive Injects - 6-10 timed injects escalating in severity - Each inject includes: timestamp, new evidence, affected systems - Decision points requiring team consensus - Red herrings and ambiguous indicators - External pressure events (media inquiry, customer complaints, regulatory call) ### Phase 3: Decision Points - Containment vs continued monitoring trade-offs - Law enforcement notification decisions - Customer/stakeholder communication timing - Business continuity activation criteria - Evidence preservation vs rapid recovery ### Phase 4: Evaluation - Rubric for each decision point - Communication effectiveness scoring - Timeline adherence assessment - Lessons learned facilitation guide - Improvement action items template Output the complete exercise package with facilitator guide, participant handouts, inject cards, and evaluation forms.
Free to copy and use. Compatible with Claude 4 Opus, Claude 4 Sonnet, GPT-5.
Select the scenario type and industry that matches your organization. Assign team roles before the exercise. Have the facilitator review all injects and decision points. Run the exercise in a conference room with a shared timeline display.
Initial release
Sign in and download this prompt to leave a review.