{"id":2017,"date":"2026-11-02T02:30:00","date_gmt":"2026-11-02T02:30:00","guid":{"rendered":"https:\/\/adnxt.com\/blog\/?p=2017"},"modified":"2026-11-09T10:59:04","modified_gmt":"2026-11-09T10:59:04","slug":"how-to-run-a-ransomware-tabletop-exercise","status":"publish","type":"post","link":"https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/","title":{"rendered":"How to Run a Ransomware Tabletop Exercise"},"content":{"rendered":"

A ransomware tabletop exercise is a structured discussion of a fictional incident. It tests decisions, communication and recovery assumptions without deploying malware or disrupting live systems. Choose a few decisions to practise and finish with assigned improvements.<\/p>\n

The Australian government’s Exercise in a Box<\/a> resources explain the discussion-based format and provide materials. The sample below is illustrative; adapt it to your business and have your security lead review the scenario.<\/p>\n

Choose the questions you need answered<\/h2>\n

For a first exercise, ask who can declare an incident, how the team communicates if email is unavailable and who decides the recovery order. A focused session is easier to assess than a scenario that tries to test every possible threat.<\/p>\n

Invite the people who would make those decisions: business leadership, IT or security, operations, customer communications and relevant advisers. Assign a facilitator to release new facts and a separate note-taker to record decisions and gaps.<\/p>\n

Set clear boundaries<\/h2>\n

Tell participants this is a discussion, which systems are assumed affected and which facts are unknown. Use fictional records. Do not send realistic threat messages to uninformed staff or make live account, network or payment changes as part of the exercise.<\/p>\n

Keep the incident response plan<\/a>, contact routes and recovery priorities available. Ask participants to use those resources rather than describing what they hope someone would do.<\/p>\n

Release a short sequence of facts<\/h2>\n
    \n
  1. Initial report:<\/strong> staff cannot open shared files and a fictional ransom message appears. Who receives the report, assesses impact and calls the response team?<\/li>\n
  2. Wider disruption:<\/strong> the normal email service is unavailable. Which trusted channel reaches decision makers and external support?<\/li>\n
  3. Recovery uncertainty:<\/strong> a backup exists, but its latest restore test and one application dependency are unclear. Who obtains evidence and sets the recovery priority?<\/li>\n
  4. External pressure:<\/strong> a customer asks whether information was exposed. Who verifies facts, seeks required advice and approves the response?<\/li>\n<\/ol>\n

    Give participants time to discuss each stage. Do not reward quick guesses. If they say \u201crestore the backup,\u201d ask who authorizes it, what must be checked first and which evidence supports the expected recovery time.<\/p>\n

    Record decisions and unresolved assumptions<\/h2>\n

    For each stage, note the decision, decision maker, information used and what was missing. Keep confirmed capabilities separate from assumptions. \u201cThe supplier can help\u201d needs a contact route and an understanding of the actual support agreement.<\/p>\n

    Questions about ransom demands, reporting and legal obligations belong with the appropriate leadership and specialists. The exercise should reveal who handles them; it should not substitute for a live incident decision.<\/p>\n

    Turn the discussion into completed work<\/h2>\n

    Finish with a short review of what helped and what blocked decisions. Assign each important gap an owner, due date and way to verify the fix. Schedule separate authorized technical tests if you need to prove backup restoration or recovery performance.<\/p>\n

    Repeat the relevant part after fixes or major changes. A completed discussion demonstrates that people practised decisions; it does not prove that systems can withstand ransomware or recover within a promised time.<\/p>\n","protected":false},"excerpt":{"rendered":"

    A two-hour facilitated scenario that tests decisions, communications, backups, vendor dependencies, and recovery assumptions.<\/p>\n","protected":false},"author":4,"featured_media":90467,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[209,191,75],"class_list":["post-2017","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorials","tag-security","tag-small-business","tag-tutorials"],"yoast_head":"\nRansomware Tabletop Exercise: A Practical Discussion Guide<\/title>\n<meta name=\"description\" content=\"Run a discussion-based ransomware exercise with a fictional scenario, decision questions and assigned follow-up work. Keep live systems untouched.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Run a Ransomware Tabletop Exercise\" \/>\n<meta property=\"og:description\" content=\"A two-hour facilitated scenario that tests decisions, communications, backups, vendor dependencies, and recovery assumptions.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/\" \/>\n<meta property=\"og:site_name\" content=\"AdNxt Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-02T02:30:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-09T10:59:04+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/adnxt.com\/blog\/wp-content\/uploads\/2026\/07\/blog-home-page-image.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1672\" \/>\n\t<meta property=\"og:image:height\" content=\"941\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Daniel Brooks\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"How to Run a Ransomware Tabletop Exercise\" \/>\n<meta name=\"twitter:description\" content=\"A two-hour facilitated scenario that tests decisions, communications, backups, vendor dependencies, and recovery assumptions.\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Daniel Brooks\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":[\"Article\",\"BlogPosting\"],\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/how-to-run-a-ransomware-tabletop-exercise\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/how-to-run-a-ransomware-tabletop-exercise\\\/\"},\"author\":{\"name\":\"Daniel Brooks\",\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/#\\\/schema\\\/person\\\/552a73ed1634fe74c885f8757c3aaa68\"},\"headline\":\"How to Run a Ransomware Tabletop Exercise\",\"datePublished\":\"2026-11-02T02:30:00+00:00\",\"dateModified\":\"2026-11-09T10:59:04+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/how-to-run-a-ransomware-tabletop-exercise\\\/\"},\"wordCount\":506,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/how-to-run-a-ransomware-tabletop-exercise\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/how-to-run-a-ransomware-tabletop-exercise.jpg\",\"keywords\":[\"Security\",\"small business\",\"Tutorials\"],\"articleSection\":[\"Tutorials\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/adnxt.com\\\/blog\\\/how-to-run-a-ransomware-tabletop-exercise\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/how-to-run-a-ransomware-tabletop-exercise\\\/\",\"url\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/how-to-run-a-ransomware-tabletop-exercise\\\/\",\"name\":\"Ransomware Tabletop Exercise: A Practical Discussion Guide\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/how-to-run-a-ransomware-tabletop-exercise\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/how-to-run-a-ransomware-tabletop-exercise\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/how-to-run-a-ransomware-tabletop-exercise.jpg\",\"datePublished\":\"2026-11-02T02:30:00+00:00\",\"dateModified\":\"2026-11-09T10:59:04+00:00\",\"description\":\"Run a discussion-based ransomware exercise with a fictional scenario, decision questions and assigned follow-up work. Keep live systems untouched.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/how-to-run-a-ransomware-tabletop-exercise\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/adnxt.com\\\/blog\\\/how-to-run-a-ransomware-tabletop-exercise\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/how-to-run-a-ransomware-tabletop-exercise\\\/#primaryimage\",\"url\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/how-to-run-a-ransomware-tabletop-exercise.jpg\",\"contentUrl\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/how-to-run-a-ransomware-tabletop-exercise.jpg\",\"width\":1200,\"height\":675,\"caption\":\"How to Run a Ransomware Tabletop Exercise illustrated with a practical small-business workflow\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/how-to-run-a-ransomware-tabletop-exercise\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Run a Ransomware Tabletop Exercise\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/\",\"name\":\"AdNxt Blog\",\"description\":\"AI Tools, Software Reviews, Marketing Guides & Business Growth Tips\",\"publisher\":{\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/#organization\",\"name\":\"AdNxt Blog\",\"url\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/adnxt-logo.png\",\"contentUrl\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/adnxt-logo.png\",\"width\":1536,\"height\":1024,\"caption\":\"AdNxt Blog\"},\"image\":{\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/#\\\/schema\\\/person\\\/552a73ed1634fe74c885f8757c3aaa68\",\"name\":\"Daniel Brooks\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/cropped-author_15-96x96.jpg\",\"url\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/cropped-author_15-96x96.jpg\",\"contentUrl\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/cropped-author_15-96x96.jpg\",\"caption\":\"Daniel Brooks\"},\"description\":\"Daniel Brooks is an AI and software analyst specializing in coding tools, business applications, and emerging technology. He simplifies complex product features to help readers make informed purchasing decisions.\",\"url\":\"https:\\\/\\\/adnxt.com\\\/blog\\\/author\\\/daniel\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ransomware Tabletop Exercise: A Practical Discussion Guide","description":"Run a discussion-based ransomware exercise with a fictional scenario, decision questions and assigned follow-up work. Keep live systems untouched.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/","og_locale":"en_US","og_type":"article","og_title":"How to Run a Ransomware Tabletop Exercise","og_description":"A two-hour facilitated scenario that tests decisions, communications, backups, vendor dependencies, and recovery assumptions.","og_url":"https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/","og_site_name":"AdNxt Blog","article_published_time":"2026-11-02T02:30:00+00:00","article_modified_time":"2026-11-09T10:59:04+00:00","og_image":[{"width":1672,"height":941,"url":"https:\/\/adnxt.com\/blog\/wp-content\/uploads\/2026\/07\/blog-home-page-image.png","type":"image\/png"}],"author":"Daniel Brooks","twitter_card":"summary_large_image","twitter_title":"How to Run a Ransomware Tabletop Exercise","twitter_description":"A two-hour facilitated scenario that tests decisions, communications, backups, vendor dependencies, and recovery assumptions.","twitter_misc":{"Written by":"Daniel Brooks","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":["Article","BlogPosting"],"@id":"https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/#article","isPartOf":{"@id":"https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/"},"author":{"name":"Daniel Brooks","@id":"https:\/\/adnxt.com\/blog\/#\/schema\/person\/552a73ed1634fe74c885f8757c3aaa68"},"headline":"How to Run a Ransomware Tabletop Exercise","datePublished":"2026-11-02T02:30:00+00:00","dateModified":"2026-11-09T10:59:04+00:00","mainEntityOfPage":{"@id":"https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/"},"wordCount":506,"commentCount":0,"publisher":{"@id":"https:\/\/adnxt.com\/blog\/#organization"},"image":{"@id":"https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/#primaryimage"},"thumbnailUrl":"https:\/\/adnxt.com\/blog\/wp-content\/uploads\/2026\/10\/how-to-run-a-ransomware-tabletop-exercise.jpg","keywords":["Security","small business","Tutorials"],"articleSection":["Tutorials"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/","url":"https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/","name":"Ransomware Tabletop Exercise: A Practical Discussion Guide","isPartOf":{"@id":"https:\/\/adnxt.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/#primaryimage"},"image":{"@id":"https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/#primaryimage"},"thumbnailUrl":"https:\/\/adnxt.com\/blog\/wp-content\/uploads\/2026\/10\/how-to-run-a-ransomware-tabletop-exercise.jpg","datePublished":"2026-11-02T02:30:00+00:00","dateModified":"2026-11-09T10:59:04+00:00","description":"Run a discussion-based ransomware exercise with a fictional scenario, decision questions and assigned follow-up work. Keep live systems untouched.","breadcrumb":{"@id":"https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/#primaryimage","url":"https:\/\/adnxt.com\/blog\/wp-content\/uploads\/2026\/10\/how-to-run-a-ransomware-tabletop-exercise.jpg","contentUrl":"https:\/\/adnxt.com\/blog\/wp-content\/uploads\/2026\/10\/how-to-run-a-ransomware-tabletop-exercise.jpg","width":1200,"height":675,"caption":"How to Run a Ransomware Tabletop Exercise illustrated with a practical small-business workflow"},{"@type":"BreadcrumbList","@id":"https:\/\/adnxt.com\/blog\/how-to-run-a-ransomware-tabletop-exercise\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/adnxt.com\/blog\/"},{"@type":"ListItem","position":2,"name":"How to Run a Ransomware Tabletop Exercise"}]},{"@type":"WebSite","@id":"https:\/\/adnxt.com\/blog\/#website","url":"https:\/\/adnxt.com\/blog\/","name":"AdNxt Blog","description":"AI Tools, Software Reviews, Marketing Guides & Business Growth Tips","publisher":{"@id":"https:\/\/adnxt.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/adnxt.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/adnxt.com\/blog\/#organization","name":"AdNxt Blog","url":"https:\/\/adnxt.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/adnxt.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/adnxt.com\/blog\/wp-content\/uploads\/2026\/07\/adnxt-logo.png","contentUrl":"https:\/\/adnxt.com\/blog\/wp-content\/uploads\/2026\/07\/adnxt-logo.png","width":1536,"height":1024,"caption":"AdNxt Blog"},"image":{"@id":"https:\/\/adnxt.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/adnxt.com\/blog\/#\/schema\/person\/552a73ed1634fe74c885f8757c3aaa68","name":"Daniel Brooks","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/adnxt.com\/blog\/wp-content\/uploads\/2026\/07\/cropped-author_15-96x96.jpg","url":"https:\/\/adnxt.com\/blog\/wp-content\/uploads\/2026\/07\/cropped-author_15-96x96.jpg","contentUrl":"https:\/\/adnxt.com\/blog\/wp-content\/uploads\/2026\/07\/cropped-author_15-96x96.jpg","caption":"Daniel Brooks"},"description":"Daniel Brooks is an AI and software analyst specializing in coding tools, business applications, and emerging technology. He simplifies complex product features to help readers make informed purchasing decisions.","url":"https:\/\/adnxt.com\/blog\/author\/daniel\/"}]}},"_links":{"self":[{"href":"https:\/\/adnxt.com\/blog\/wp-json\/wp\/v2\/posts\/2017","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adnxt.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adnxt.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/adnxt.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/adnxt.com\/blog\/wp-json\/wp\/v2\/comments?post=2017"}],"version-history":[{"count":3,"href":"https:\/\/adnxt.com\/blog\/wp-json\/wp\/v2\/posts\/2017\/revisions"}],"predecessor-version":[{"id":90598,"href":"https:\/\/adnxt.com\/blog\/wp-json\/wp\/v2\/posts\/2017\/revisions\/90598"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/adnxt.com\/blog\/wp-json\/wp\/v2\/media\/90467"}],"wp:attachment":[{"href":"https:\/\/adnxt.com\/blog\/wp-json\/wp\/v2\/media?parent=2017"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adnxt.com\/blog\/wp-json\/wp\/v2\/categories?post=2017"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adnxt.com\/blog\/wp-json\/wp\/v2\/tags?post=2017"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}