Ransomware Tabletop Exercise Scenarios

Introduction

A ransom note tests far more than technical controls. It forces leaders to decide on containment, communications, business continuity, recovery, legal obligations, and customer trust, often within hours and with half the facts.

The FBI's 2025 IC3 report logged more than 3,600 ransomware complaints, and the sectors hit hardest included healthcare and critical manufacturing. Many organizations discover during a real incident that nobody knows who can declare one.

This guide gives you six ransomware tabletop exercise scenarios, escalation injects, discussion questions, and follow-up actions. Adapt them to your systems, industry, and size.

Key Takeaways

• Build scenarios around your real critical systems, vendors, and recovery dependencies.
• Test business decision-making, not just the security team's containment skills.
• Add injects: stolen data, compromised backups, unreachable executives, reporters.
• Treat the after-action report as the start of remediation, with owners and deadlines.

What Is a Ransomware Tabletop Exercise and Why Does It Matter?

What a ransomware tabletop exercise tests

A ransomware tabletop exercise is a discussion-based simulation. Participants talk through a hypothetical attack using your actual incident response and continuity plans, without touching live systems. NIST SP 800-84 describes discussion-based exercises as ones that don't deploy equipment or resources.

The session evaluates:

• Who owns each decision, and how escalation works
• Who has containment authority
• How confident you are in your backups
• Recovery priorities and essential operations
• Communications to staff, customers, and regulators

Why ransomware needs its own exercise

Ransomware becomes a business crisis quickly. It brings downtime, possible data theft, legal review, insurer requirements, and customer questions at once.

Speed matters too. CISA documented Akira incidents in which data left the network in just over two hours from initial access. That is not an average, but it shows how little time leaders may have.

Data theft is common as well: Coveware found exfiltration in 76% of its Q3 2025 cases.

CISA and the FBI recommend regularly exercising ransomware and data-extortion response and communications plans.

Who should participate

Invite the people who would actually make decisions:

• Security and IT responders, plus the incident manager
• Executive leadership and legal counsel
• Communications, HR, finance, and operations
• Business continuity and cyber insurance contacts
• Critical vendors, where appropriate

Assign clear roles:

• Players discuss their normal responsibilities
• Facilitators present the scenario and keep time
• Evaluators document decisions against plans
• Observers watch, and note-takers record decisions and rationale

Senior leaders must play. If technical staff answer every question, you learn nothing about who can approve a shutdown, a notification, or a payment evaluation.

How to Design a Realistic Ransomware Tabletop Exercise

Start with your risk profile and one objective

Map the services, applications, data stores, cloud environments, OT, remote access paths, and third parties that would shape a real event.

Then pick one primary objective: incident declaration, backup recovery, executive decisions, customer communication, or continuity of critical operations. Trying to test everything tests nothing.

Write the objective so it is specific and measurable. HSEEP's SMART framework is a good model.

Build a three-stage arc

1. Initial signal: a few symptoms, such as locked files or odd logins.
2. Escalation: new facts arrive, including scope, data theft, or failed recovery.
3. Containment and recovery: leaders choose priorities and communicate.

Define what players know at the start. Leave the infection vector, attacker access, data exposure, and backup integrity uncertain, as they would be in real life.

Create progressive injects

Use timed complications that force a decision, such as:

• A second ransom note
• Evidence of exfiltration
• Inaccessible backups
• A compromised admin account
• A reporter asking for comment
• A vendor going dark
• An executive who can't be reached

Every inject should test a specific decision. Drama without a learning goal wastes the room's time.

Set ground rules and success criteria

Keep a no-blame tone. Require players to use the current incident response plan, not an idealized one. Success criteria might include:

• Naming the incident manager
• Activating the right communications channel
• Documenting a containment decision
• Setting recovery priorities
• Escalating legal questions
• Recording unresolved gaps

Adapt to your environment

Vary the exercise for cloud-first firms, healthcare, manufacturing and OT, higher education, public sector, financial services, and SaaS or MSP-dependent companies. Notification and contractual rules differ by sector, so confirm current requirements with counsel. Nothing here is legal advice.

Ransomware Tabletop Exercise Scenarios to Run

1. Phishing-to-ransomware enterprise outage

Stolen credentials from a phishing campaign let attackers move laterally. At the start of the workday, several departments find encrypted files. CISA's Medusa advisory lists phishing as a primary credential-theft method.

Injects:

• Suspected domain administrator compromise
• Unclear authority to declare an incident
• Leadership demanding immediate restoration
• Employees asking whether to keep using their devices

Ask:

• Who isolates systems?
• Who preserves evidence?
• Who tells employees?
• Which business functions come first?

2. Double-extortion attack with data theft

Start with encrypted systems, then reveal that customer, employee, or financial data was copied first. Test how legal, privacy, communications, and security leaders scope the exposure and run notification analysis.

Ask:

• How do you communicate uncertainty?
• When do law enforcement and insurers join?
• How do you evaluate negotiation without assuming payment guarantees deletion?

The FBI and CISA do not recommend payment, since it doesn't ensure decryption or prevent leaks.

3. Backup compromise and recovery failure

Reveal that the backup admin account may be compromised, recent backups are missing, or restore documentation is incomplete. CISA recommends offline, encrypted backups with regular availability and integrity testing.

Ask:

• How do you validate integrity and choose a clean restore point?
• Who has recovery authority?
• What manual workarounds exist?

The lesson: having backups isn't the same as proving restoration works.

4. Third-party or supply-chain ransomware

A software provider, MSP, or payroll vendor is hit. The 2021 Kaseya VSA attack, which reached multiple MSPs and their customers, is the classic case.

Ask:

• How does the vendor notify you?
• What do contracts require?
• Can you revoke access?
• Do you disconnect a vendor if that interrupts essential services?

5. Cloud identity compromise

A privileged cloud, identity provider, or SaaS admin account is the entry point, followed by suspicious access to storage and backups. CISA's Scattered Spider advisory documents MFA abuse, AWS lateral movement, and data theft from cloud platforms.

Ask:

• Which conditional access changes do you make?
• How do you revoke sessions and tokens?
• What federation dependencies exist?
• How do you confirm recovered accounts are trustworthy?

6. Ransomware affecting critical operations

Tailor this for a hospital, manufacturer, university, or municipality where downtime touches patient care, production, instruction, or public services.

Change Healthcare's 2024 attack forced manual pharmacy claims. Ascension used downtime procedures after its May 2024 attack, and EHR access returned across ministries in mid-June.

Injects:

• Limited staffing
• Dead communications systems
• Pressure to restore unverified systems
• Competing priorities between technical recovery and service delivery

How to Run and Facilitate the Exercise

Prepare participants and materials

Before the session, circulate:

• Objective, scope, ground rules, and roles
• Current incident response and continuity plans
• Contact lists, asset information, and vendor and insurer contacts

The facilitator controls information flow. Evaluators record decisions and gaps. Note-takers capture actions.

Open and drive discussion

Share only the initial facts. Ask what players would do first and which plan gives them authority. Have them separate confirmed facts, assumptions, and open questions. That split shows where visibility is missing.

After each inject, ask:

• Who owns the next decision?
• What information is missing?
• What can be authorized now?
• Who must be told?
• What evidence must be preserved?

Keep the talk on decisions and coordination, not malware families or tool debates.

Test communications and continuity

Assume email, identity systems, or phones are down or suspect. CISA's ransomware guide recommends out-of-band methods such as phone calls during coordinated isolation. Ask how teams reach employees, customers, regulators, vendors, insurers, law enforcement, media, and the board while facts are still moving.

Hot wash and after-action report

Right after the scenario, ask what worked, what failed, which assumptions were wrong, and where ownership was unclear. Record delays, missing contacts, untested dependencies, and disagreements over ransom, restoration, notification, or shutdown.

Then write the after-action report. Each corrective action needs an owner, business impact, resources, dependencies, and a target date. CISA's planner guidance recommends circulating the final report within two weeks of the after-action meeting.

Feed those findings into your IR plan, recovery procedures, contact trees, vendor requirements, training, backup testing, and communications templates.

How to Turn Exercise Findings Into Improved Ransomware Readiness

Prioritize by business impact

Separate quick exposure-reduction fixes from longer maturity work. Rank first the gaps that delay containment, compromise recovery, affect safety, or create legal and contractual exposure.

Track open decisions such as:

• Ransom authority
• Incident manager appointment
• Recovery sequencing
• External communications approval
• Insurer or law enforcement escalation

Validate assumptions with hands-on tests

A discussion proves nothing about whether controls work. Follow up with targeted testing:

• Backup restoration
• Identity recovery
• Endpoint isolation
• Network segmentation review
• Alternate communications
• Manual continuity procedures

Get the right expertise

Organizations without senior security leadership, 24/7 monitoring, or a clear compliance owner often struggle to close these gaps alone.

DeepSeas offers strategic advisory, threat intelligence, managed detection and response through its CyberFusion SOC, and governance, risk, and compliance support. Its incident response readiness work covers escalation and decision rights, communication templates, and evidence retention. The focus is a prioritized list of changes rather than a participation summary.

Frequently Asked Questions

What is a ransomware tabletop exercise?

It is a discussion-based simulation where cross-functional participants talk through detection, containment, communication, and recovery during a hypothetical ransomware attack. No live systems are affected.

How do you run a ransomware tabletop exercise?

Set an objective, prepare the scenario, assign roles, and release injects in stages. Facilitators ask decision questions, then lead a hot wash and produce an after-action report.

What should a ransomware tabletop scenario include?

A realistic starting condition, affected business services, escalation injects, and clear decision points. Add communication challenges, recovery constraints, and defined success criteria.

Who should participate?

IT and security, executives, legal, communications, HR, finance, operations, and business continuity. Add relevant vendors and insurance contacts.

How often should you run one?

Run them regularly, based on risk. HHS's 405(d) program recommends tabletop exercises at least annually, and NIST advises repeating after major changes. Add sessions after acquisitions, incidents, leadership changes, or critical vendor shifts, and check your sector's rules.

Should the exercise include a ransom payment decision?

Yes, as a test of process, not an answer. Check who has authority to evaluate payment, what legal and sanctions reviews apply, what alternatives exist, and how leaders communicate the outcome.