How to Run a Ransomware Tabletop Exercise with a Non-Technical Team

How to Run a Ransomware Tabletop Exercise with a Non-Technical Team

The call comes at 8:40 on a Thursday. A customer of eleven years says the invoice you emailed last week carries a different bank account number, and the payment has already left their account. The finance manager pulls the email thread. The bank details look almost right, except for two digits. Nobody in the room is a network engineer. The people in the room are a finance manager, a lawyer, a communications lead and an operations director, which is exactly who makes the first real decisions when ransomware hits. Tabletop exercises are usually built for the security team. This one is for everyone else.

Why a non-technical team should rehearse

During the first four hours of a ransomware incident, most decisions are not technical. Do we pay? Who calls the insurer, and what do we say? Do we tell customers before the story tells itself? Can payroll run next week without the HR system? Engineers handle containment; managers, legal and communications handle consequence. If those two groups have never sat in the same room, the handoff fails at the worst possible moment.

Consider a common failure. Finance discovers a fraudulent payment while operations still believes the problem is a simple email outage. Legal is drafting a regulatory notification based on assumptions nobody has confirmed. Communications is waiting for approval from an executive who does not know they are the approver. Each person is competent. The system around them is not. A tabletop exercise exposes that system before a real attacker does.

There is a second benefit. Rehearsing gives non-technical staff just enough vocabulary to ask useful questions. When someone says the backups are offline, the finance lead should know whether that means "safe" or "unreachable". Ninety minutes buys that. It also teaches leaders what not to ask. "Can you just hack them back?" is not a plan, and a good facilitator will let the room discover why.

There is a third benefit: confidence. People who have practiced saying "I need to escalate this" are faster to do it under pressure. They also know which decisions they are not authorised to make, which is just as important.

Ground rules before the clock starts

Put these on a slide, read them out, then start the clock.

• Ninety minutes, hard stop. The exercise ends mid-crisis, because the first real meeting will too.
• One facilitator who does not play a role. They read the injects and keep time.
• One scribe. Every decision gets a timestamp and a name.
• "I don't know" is a valid answer, provided somebody writes down who would know.
• Injects arrive on schedule whether or not you have solved the previous one.
• Score the response, never the person.
• Keep an IT colleague on standby to answer one question at a time. Do not let them take over the room.

The facilitator's job is to protect the pace, not to teach. If discussion stalls, ask "Who would decide?" and move on. If the same person answers every question, invite another role: "Finance, what do you need from legal before you can answer?" The silence that follows is useful data.

The scenario: "Invoice Thursday"

Read this aloud. Your company is a mid-sized services firm. Someone in accounts payable opened a phishing attachment on Wednesday evening. By Thursday morning, files on the shared finance drive will not open, and a text file with a ransom demand sits in every folder. Two clients report receiving emails from your domain with altered bank details. The demand gives you 72 hours. The attacker also threatens to publish payroll data, and your incident response provider is 90 minutes away. The clock starts now.

Facilitator note: Do not let the group solve the technical problem. The technical problem is a backdrop. The exercise is about decisions, authority and communication.

Inject 1 — 08:40, the customer call

A client calls the finance desk asking why your bank details changed. Nobody sent that email. The finance manager has the customer on hold. Who takes the call, and what are they allowed to say? Can they confirm a breach? Can they promise a refund? Write down the exact sentence the first person would use.

Inject 2 — 09:15, the ransom note

The note appears on the shared drive with a payment deadline and a chat link. It includes a sample of employee records to prove access. Who, if anyone, is authorised to open a conversation with the attacker? Does the insurer or outside counsel need to approve that contact? If nobody is authorised, who makes that decision today?

Inject 3 — 10:05, the journalist

A reporter emails asking you to confirm "a cyber incident" at the company. They say they have a screenshot of the ransom note. Who approves the reply, and how long do you have before they publish without you? What is the holding statement, and who is allowed to say "no comment"?

Inject 4 — 11:30, payroll

Payroll runs in three days and the HR system is unreachable. Some employees are paid by direct deposit, others by cheque. What can be paid manually, and who signs it off? How do you tell staff without using email? What happens to new starters and contractors?

Inject 5 — day two

An employee posts that it has been "a rough week at work". The insurer also wants a written incident summary by close of business. Who writes it, and who reads it before it goes out? Add a twist: the post has three comments asking if the company was hacked.

Discussion prompts that surface the hard parts

Work through these as the injects land. Two of them will produce an uncomfortable silence, which is the point.

• Legal and regulatory: What is the company obliged to report, to whom, and by when? Who is our single point of contact at outside counsel?
• Communications: Who approves the first statement, and how do we reach staff if email is untrusted?
• Finance: Who has authority to approve a payment to a criminal group, and is there a ceiling?
• Operations: What can we still quote, ship or bill for forty-eight hours, and who authorises manual workarounds?
• People: Who speaks to the colleague whose account was compromised? Is this a disciplinary matter or a support matter, and who decides?

If the group finishes early, return to the first inject and ask them to write a 50-word customer statement. The constraint is the lesson: legal, communications and operations must agree on every word.

Preparation: what to gather before the room fills

A tabletop exercise fails if the room lacks basic inputs. You do not need a full incident response plan, but you do need the following in a shared folder or printed pack.

• One-page contact list: insurer, outside counsel, incident response retainer, key customers, regulators and internal approvers. Mark who can be called after hours.
• Decision rights: who can approve payment, who can speak to press, who can shut down a system, and who can authorise overtime.
• Manual workarounds: how payroll, invoicing and customer support run for 48 hours without core systems.
• Latest incident response plan: even if it is imperfect. The exercise will show you what to fix.
• A clock and a visible agenda: 90 minutes, five injects, one hotwash.

Assign a note-taker who is not playing a role. The scribe should capture decisions, owners, deadlines and unanswered questions in a simple table. That table becomes the after-action list.

The hotwash: turning ninety minutes into ten fixes

Stop at the hard deadline, even if the scenario is unresolved. The last fifteen minutes are the most valuable. Ask each participant three questions: What was your first decision? What did you need that you did not have? Who did you assume was responsible?

1. List the top three gaps. For example, no one knew whether the insurer required notification within 24 hours, or the customer service team had no approved holding statement.
2. Assign one owner and one date per gap. "Update contact tree" is not a fix. "Priya will confirm after-hours numbers for insurer and counsel by Friday" is.
3. Schedule the next exercise. Put a 60-minute follow-up on the calendar in 90 days. Change one variable: make it a weekend, remove the legal lead, or add a data leak.

Write a one-page summary for executives. Include what the team decided, what it could not decide, and what it needs. Do not turn the summary into a blame document. The exercise is a rehearsal, not an audit.

Finally, repeat the opening scene at the next exercise. The same 8:40 call, the same altered bank details. If the second run is smoother, the team has learned. If it is not, you have found the next gap while the cost is still measured in minutes, not millions.

Photo: Alena Darmel / Pexels