Generate a tabletop scenario from 6 archetypes (ransomware, BEC, supply-chain, espionage, edge-exploit, insider) populated with a real threat-actor profile from the catalog. Inject sequence with role-specific discussion prompts; markdown export for your facilitator pack.
Designed for 60-90 minute exercises with IR Lead, Tech Lead, Communications, Legal, and Executive Sponsor at the table.
Supply-chain compromise
Wednesday 09:00 — a vendor publishes a security advisory.
A widely-used IT-management vendor publishes an advisory: their software-update channel was compromised. Customers who took updates between two specific dates received a backdoored binary. Your team's update history is within that window. APT28 is the attributed actor. The Government sector is mentioned as a target.
T+0
Vendor advisory + IoC pack
Vendor publishes an advisory with hashes, C2 domains, and a YARA rule. Public attribution names APT28.
Discussion prompts
Tech LeadHow fast can we sweep our environment for the IoCs? Do we have 90-day retention?
IR LeadWho owns the vendor relationship? When was the last vulnerability assessment of their access?
LegalContractual obligations — does the vendor owe us forensic detail?
T+2 h
Beacon traffic confirmed
EDR retro-hunt finds outbound TLS to one of the C2 domains from a server that received the backdoored update.
Discussion prompts
Tech LeadWhat did this server have access to? Crown-jewel data? Lateral-movement potential?
CommunicationsAre we telling customers anything yet? When?
Executive SponsorWhat is the worst-case scope? Who needs to know now?
T+4 h
Lateral movement evidence
Endpoint forensics shows the implant ran for 14 days and likely accessed credentials for service accounts that interact with cloud production.
Discussion prompts
Tech LeadMass credential rotation — what is the order of operations? What breaks first?
LegalWhen does this become a notifiable event?
IR LeadDo we keep operating, partial-shutdown, or full-shutdown? What does the BIA say?
Facilitator notes
Time-box. 10-15 minutes per inject keeps a 60-90 minute exercise on track.
Don't break the fourth wall. If a participant says "we'd just check our runbook" — make them run it. The point is to find the gap.
Decision logs. Capture who decided what, on what evidence — that's the artefact you actually want from a tabletop.