Tabletop Exercise Scenarios With Injects (Free DOCX).

This kit has everything to run a discussion-based exercise in one sitting: a planning table, roles, ground rules, a time plan, six scenarios with timed injects, and a scoring and after-action table. An inject is a new fact the facilitator reads out at a set time, so the team has to react to a changing story.

The structure follows public guidance. CISA publishes CISA Tabletop Exercise Packages, which bundle objectives, scenarios, discussion questions, slide decks and after action report templates. NIST SP 800-84 covers how to design, develop, conduct and evaluate test, training and exercise events for IT plans (NIST SP 800-84, September 2006). ENISA’s Cybersecurity Exercise Methodology (February 2026) describes planning, running and evaluating exercises end to end. Use them for depth. This kit adds the external-threat side: the scenarios start from signals found outside your network.

The external signal is the first inject in every scenario. It is a lookalike domain, a leaked login, a fake account, a forum post, a leak-site listing or a supplier alert. Each scenario links to the matching how-to-respond page so the team can compare its answer with a written one.

Pair this kit with the incident response plan template and the ransomware response playbook and checklist. A tabletop is the cheapest way to find the holes in both.

Start with what you want to learn, not with a scenario. Write two or three objectives, say how you will see each one, and keep the exercise small enough to finish.

Run no more than one scenario per sitting at first. Each scenario here fits about 60 minutes of play.

Players use their real roles. The facilitator and note taker do not play. Write a name next to each role.

Ground rules

• This is a discussion, not a test of people. Mistakes are the point.
• Say what you would really do with the tools and contacts you have today.
• Nothing in the room is live. Do not open real leaked data, contact sellers, or touch real systems.
• The facilitator can pause the clock to ask why. Stay on the inject in front of you.
• Notes are shared with the group, not used for appraisal.
• If you do not know who owns something, write it down. That is a finding.

A 90 minute session works well for one scenario. Cut the injects, not the review, if you run short.

The diagram shows how the injects in each scenario escalate: the signal arrives, customers or staff are hit, a third party answers slowly, press or regulators ask, the scope grows, and the team closes and learns.

Objective. Test how fast the team confirms a fake login site, protects customers and starts a takedown, and who owns each step.

Participants. Security lead, SOC analyst, brand or fraud owner, legal, communications, customer support, web or IT, [other].

Where the external signal enters. A brand monitoring alert shows a new domain one character away from yours. It has a valid certificate and a login page that copies yours.

Discussion questions

Related technique, confirmed on MITRE ATT&CK: Phishing (T1566).

1. Who has the authority to ask a registrar or host to take a domain down, and how long does it take to reach them?
2. What do we tell customers, and what do we ask them not to do?
3. Which of our own logs show who visited the fake site?
4. How do we learn about the next lookalike before customers do?

Compare your answers with: How to respond to lookalike and phishing domains; Phishing and lookalike domains use case; Brand impersonation takedown use case.

Objective. Test whether a leaked login for an admin account is treated as a live intrusion, not a password reset ticket.

Participants. Security lead, SOC analyst, identity or IT admin, endpoint team, legal or privacy, the account owner, [other].

Where the external signal enters. A threat intelligence alert says an infostealer log lists a work email, password and session cookies for an administrator.

Discussion questions

Related technique, confirmed on MITRE ATT&CK: Valid Accounts (T1078).

1. How would we have learned about this log without the alert?
2. Which sessions and tokens survive a password reset in our setup?
3. Who decides to disable a senior person’s account in the middle of the day?
4. What do we do about personal devices that touch company systems?

Compare your answers with: How to respond to infostealer log exposure; How to respond to leaked credentials; How to respond to initial access listings; Leaked credential monitoring use case.

Objective. Test how the team collects evidence and reports fakes to several platforms at once, and how it speaks to customers while it does.

Participants. Brand or fraud owner, security lead, social media manager, legal, communications, customer support, mobile or web team, [other].

Where the external signal enters. A customer posts a screenshot of a direct message from a “support” account that is not yours.

Discussion questions

If you plan to use a service for the reporting and takedown steps, the Takedown Service Evaluation Checklist lists what to ask.

1. Where is the list of our official accounts, domains and apps, and can customers find it?
2. Which platforms do we already have a reporting contact for?
3. Who signs the trademark and authorization paperwork?
4. How do we measure that a fake is gone, not only reported?

Compare your answers with: How to respond to fake social media accounts; How to respond to fraudulent ads using your brand; How to respond to fake mobile apps; Brand impersonation takedown use case.

Objective. Test how the team checks a seller’s claim, preserves evidence without buying stolen data, and decides on notification and customer messages.

Participants. Security lead, analyst, data or application owner, legal and privacy, communications, customer support, executive sponsor, [other].

Where the external signal enters. A monitoring alert shows a forum post that offers a “customer database” for sale with a small sample.

Discussion questions

1. Who is allowed to look at a leak site or forum, and on which device?
2. Which facts do we need before we tell customers?
3. What do we do if the sample is real but we cannot find the breach?
4. How do we know the data does not appear again somewhere else?

Compare your answers with: How to respond to leaked databases and source code; Data leak detection use case; Incident reporting deadlines: NIS2, CRA, SEC, CIRCIA.

Objective. Test the first hours of a ransomware event, including the extra pressure of a public listing and a deadline.

Participants. Incident lead, IT operations, security lead, executive sponsor, legal, communications, HR, finance, insurer contact, [other].

Where the external signal enters. Staff report that files will not open. A ransom note is on several servers.

Discussion questions

For prevention and response steps, see the CISA and MS-ISAC #StopRansomware Guide.

1. Who can make the call on payment, and what do they need to know first?
2. What do we say to staff, customers and the press while systems are down?
3. How would we find out about a listing before the group contacts us?
4. What would we do if backups were also encrypted?

Compare your answers with: How to respond to ransomware leak site listings; Ransomware early warning use case; Ransomware response playbook and checklist.

Objective. Test how the team learns that a supplier was hit, finds what that supplier can reach, and uses the contract to get answers.

Participants. Security lead, third-party risk owner, procurement, the supplier’s business owner, IT, legal, [other].

Where the external signal enters. A monitoring alert shows one of your suppliers on a ransomware leak site.

Discussion questions

If supplier exposure is a gap, the Attack Surface Management Tools buyer’s guide shows what outside-in monitoring can cover.

1. Do we know our critical suppliers and what each can reach?
2. What does the contract let us demand after a supplier incident?
3. How fast can we cut a supplier’s access, and who decides?
4. How would we hear about this if the supplier stayed silent?

Compare your answers with: How to respond when a supplier is on a leak site; How to respond to a supplier’s new exposure signal; Supply chain and vendor risk use case; Vendor cyber risk questionnaire template.

Score each decision point right after the exercise, while memory is fresh. Use a simple scale, then turn every gap into an action with an owner and a date.

After-action report outline

1. Exercise name, date, scenario, facilitator and players.
2. Objectives and whether each was met.
3. What went well.
4. Gaps, with the inject where each showed up.
5. Actions with owners and dates (use the table above).
6. Plan or contact-list changes to make.
7. Date of the next exercise.

Update your incident response plan with the changes, then repeat the exercise to see if the gaps closed. The CISA Tabletop Exercise Packages include feedback forms and an After Action Report template if your organization needs a formal format.

Each source below was opened and checked before this page was written. The exercise steps are paraphrased and adapted, not copied.