10 Real-World Tabletop Exercise Scenarios That Work
Skip the theoretical exercises. These 10 proven scenarios are based on actual incidents and designed to test your organization's real-world response capabilities. Each scenario includes setup instructions, decision points, and success metrics.
📌 Key Takeaways
- •10 proven scenarios included: BEC, ransomware, cloud breaches, insider threats, supply chain attacks, social engineering, IoT botnets, SQL injection, physical security, and zero-day exploits.
- •Each scenario includes: Setup instructions, key decision points, and measurable success metrics.
- •Real-world scenarios outperform generic exercises because they reflect the complexity and unpredictability of actual incidents.
- •Best practices: Include cross-functional teams, focus on decision-making, and use scenarios to identify procedural gaps.
Why Real-World Scenarios Matter
Real-world attack scenarios your team needs to be prepared for
Learn how to implement these 10 scenarios in your organization
Generic tabletop exercises often fall short because they don't reflect the complexity and unpredictability of actual security incidents. The scenarios below are based on real attacks that have affected organizations across industries, ensuring your team practices responses to threats they're likely to encounter.
Scenario 1: Business Email Compromise (BEC)
Scenario Setup:
Your CFO receives an urgent email from the CEO requesting an immediate wire transfer to a new vendor. The email appears legitimate but arrives during a time when the CEO is traveling.
Key Decision Points:
- How does your team verify the legitimacy of financial requests?
- What backup communication channels exist for urgent approvals?
- Who has authority to halt financial transactions during investigations?
Success Metrics:
- Time to implement verification procedures
- Effectiveness of out-of-band confirmation process
- Quality of documentation during investigation
Scenario 2: Ransomware with Data Exfiltration
Scenario Setup:
Systems across multiple departments begin displaying ransomware messages. Initial investigation reveals that sensitive customer data may have been exfiltrated before encryption began.
Key Decision Points:
- When to activate incident response team vs. crisis management team
- How to balance investigation with business continuity needs
- Communication strategy for customers and regulatory bodies
- Decision criteria for involving law enforcement
Scenario 3: Cloud Service Provider Breach
Scenario Setup:
Your primary cloud provider notifies you of a security incident affecting their infrastructure. They provide limited details but confirm that customer data may have been accessed.
Key Decision Points:
- How to assess impact with limited information from the provider
- When to activate backup systems or failover procedures
- Customer notification requirements and timing
- Legal and compliance implications
Scenario 4: Insider Threat - Departing Employee
Scenario Setup:
HR reports that a system administrator with privileged access is leaving the company under contentious circumstances. Log analysis reveals unusual data access patterns in the weeks leading up to their departure.
Key Decision Points:
- Immediate access revocation vs. continued monitoring
- Coordination between HR, Legal, and IT Security
- Evidence preservation for potential legal action
- Assessment of compromised systems and data
Scenario 5: Supply Chain Attack
Scenario Setup:
A security update from a trusted software vendor contains malicious code that has been deployed across your organization. The vendor publicly acknowledges the compromise after the malicious update has been installed.
Key Decision Points:
- Immediate containment vs. impact assessment
- Rolling back updates while maintaining security posture
- Coordinating with other affected organizations
- Long-term vendor risk assessment changes
Scenario 6: Social Engineering Attack on Help Desk
Scenario Setup:
Multiple help desk tickets report users unable to access their accounts. Investigation reveals that attackers have been calling the help desk, impersonating employees, and convincing staff to reset passwords and disable multi-factor authentication.
Key Decision Points:
- Immediate changes to help desk verification procedures
- Identifying all potentially compromised accounts
- Communication to help desk staff and end users
- Implementation of enhanced authentication requirements
Scenario 7: IoT Device Botnet
Scenario Setup:
Network monitoring alerts indicate that IoT devices throughout your facilities are generating unusual outbound traffic. External threat intelligence suggests these devices have been compromised and are participating in a botnet.
Key Decision Points:
- Balancing device functionality with security containment
- Coordinating with facilities management and operations teams
- Assessment of data that may have been accessible to compromised devices
- Long-term IoT security architecture changes
Scenario 8: Database Injection Attack
Scenario Setup:
Application monitoring detects unusual database queries that suggest a SQL injection attack. Preliminary analysis indicates that customer records may have been accessed and potentially modified.
Key Decision Points:
- Taking applications offline vs. implementing temporary protections
- Data integrity verification and restoration procedures
- Customer notification about potential data access
- Coordinating with development teams for rapid patching
Scenario 9: Physical Security Breach
Scenario Setup:
Security cameras capture unauthorized individuals in a restricted area of your data center. Physical security reports that access cards may have been cloned, and there are signs that equipment may have been tampered with.
Key Decision Points:
- Immediate physical security lockdown procedures
- Technical assessment of potentially compromised equipment
- Coordination between physical and cybersecurity teams
- Evidence preservation for law enforcement involvement
Scenario 10: Zero-Day Exploit in Critical Infrastructure
Scenario Setup:
Government agencies issue warnings about a zero-day vulnerability being actively exploited in software that's critical to your operations. No patches are available, and the vulnerability affects systems that cannot be easily taken offline.
Key Decision Points:
- Risk assessment when no patches are available
- Implementation of compensating controls
- Business continuity with increased security measures
- Communication with stakeholders about ongoing risks
Implementing These Scenarios
Effective tabletop exercises require cross-functional team participation
Each scenario should be customized to your organization's specific environment, systems, and procedures. Consider these implementation tips:
- Start with scenarios most relevant to your industry and threat profile
- Include realistic time pressures and resource constraints
- Incorporate your actual incident response procedures and tools
- Include representatives from all stakeholder groups
- Focus on decision-making processes, not just technical responses
Ready to Test Your Team with Real Scenarios?
ChaosTrack's platform includes these scenarios and many more, with built-in facilitator guides, success metrics, and automated reporting. Our platform makes it easy to run realistic incident response simulations that truly prepare your team for real-world threats.
Start Your Demo