Loading...
Ransomware
How to Run a Ransomware Tabletop Exercise
A complete, step-by-step guide to planning and executing ransomware tabletop exercises that prepare your team for real attacks.
16 min read
Security & IR Teams
Why Ransomware Exercises Matter
Ransomware attacks increased 105% in 2023, with average ransom demands reaching $1.5 million. The average downtime is 21 days, costing businesses an additional $4.54 million in lost revenue. Organizations that practice ransomware response contain attacks 38% faster and experience 60% less data loss.
What Makes Ransomware Exercises Different?
Ransomware attacks are unique because they combine technical, legal, financial, and reputational challenges simultaneously. Your exercise must test all these dimensions:
Technical Response
Isolation, forensics, eradication, recovery
Financial Decision
Pay or don't pay the ransom?
Legal Coordination
Law enforcement, regulatory notification
Business Continuity
Operations during 21+ day recovery
Pre-Exercise Preparation (2-3 Weeks Before)
Proper planning ensures a realistic and valuable exercise. Follow these preparation steps:
Select Ransomware Variant
Choose a specific ransomware family to simulate. Popular choices:
- LockBit: Fast encryption, data exfiltration, double extortion
- BlackCat (ALPHV): Cross-platform (Windows/Linux), API-driven
- Royal: Targets enterprises, partial encryption for speed
- Clop: Exploits vulnerabilities, focuses on data theft
Identify Participants
Ransomware response requires cross-functional teams:
- IT/Security: Detection, containment, forensics, recovery
- Executive Leadership: Decision authority for ransom payment
- Legal Counsel: OFAC compliance, breach notification, contracts
- Finance: Payment mechanisms, insurance claims
- Communications: Internal messaging, customer notification, media
- HR: If employee data compromised
Gather Infrastructure Documentation
Exercise realism depends on accurate environment details:
- Network diagrams and segmentation
- Critical system inventory with RPO/RTO
- Backup architecture and recovery procedures
- EDR/SIEM coverage and gaps
- Offline backups and their location
- Disaster recovery plan
Review Current Procedures
Identify what you're testing:
- Ransomware response playbook (if exists)
- Backup and restore procedures
- Communication trees and templates
- Cyber insurance policy coverage and requirements
- Vendor support contracts (IR retainer, backup vendor)
Define Exercise Objectives
What specific capabilities are you testing?
- Detection speed and accuracy
- Isolation and containment procedures
- Backup recovery capability
- Ransom payment decision framework
- Cross-team communication and coordination
- Leadership decision-making under pressure
Sample Exercise Timeline (90 Minutes)
Here's a proven timeline for a ransomware tabletop exercise. Adjust based on your team's experience and objectives:
0-15m
Introduction & Scenario Setup
15-45m
Initial Response & Discovery
45-75m
Decision Points & Escalation
75-90m
Debrief & Lessons Learned
The Ransom Payment Decision
The toughest decision in ransomware response: Should you pay? Walk your team through this decision framework:
Factors AGAINST Paying
- You have clean, tested backups
- Paying may violate OFAC sanctions
- No guarantee decryption works (30% fail)
- Encourages future attacks
- Reputational damage if disclosed
- Board/legal policy prohibits payment
Factors FOR Paying
- No viable backups exist or corrupted
- Downtime cost exceeds ransom amount
- Life-safety systems affected (healthcare)
- Data exfiltrated + threatened release
- Recovery time exceeds MTD by weeks
- Cyber insurance covers payment
Discussion Point: OFAC Sanctions
The FBI and Treasury's OFAC discourage ransom payments. Paying sanctioned threat actors (like many ransomware groups) may violate federal law, even if you didn't know. Always involve legal counsel before payment decisions.
Key Decision Points to Test
Your exercise should force participants to make real decisions. Include these critical decision points:
1
Isolation Decision
Scenario: You detect encryption on 3 servers. Do you isolate entire network segment (kills production) or just affected systems (may allow spread)?
Tests: Technical judgment vs business impact tolerance
2
Backup Trust
Scenario: Your last clean backup is 4 days old. Recent backups show suspicious activity. Do you restore old backup (lose 4 days data) or risk restoring compromised backup?
Tests: Risk assessment and data loss tolerance
3
Ransom Negotiation
Scenario: Attacker demands $2M. Recovery from backups will take 28 days. Cyber insurance covers $1M ransom. What do you do?
Tests: Financial decision-making and negotiation strategy
4
Public Disclosure
Scenario: Local news contacts you about "ransomware at your company." Do you confirm, deny, or "no comment"? When do you proactively disclose to customers?
Tests: Communications strategy and transparency
Post-Exercise Analysis
The debrief is where real learning happens. Capture these insights immediately after the exercise:
What Went Well
- Which decisions were made quickly and confidently?
- What procedures or playbooks worked as intended?
- Which teams communicated effectively?
- What documentation was readily available?
What Needs Improvement
- Where did participants get stuck or confused?
- What information was missing or hard to find?
- Which decisions took too long or lacked clear authority?
- What procedures don't exist but should?
Action Items (Prioritized)
- Critical (Fix This Week): Issues that would cause response failure
- High (Fix This Month): Gaps that significantly slow response
- Medium (Fix This Quarter): Improvements that enhance effectiveness
- Low (Consider Long-Term): Nice-to-have enhancements
Run Ransomware Exercises with Pre-Built Scenarios
Breakpoint provides realistic ransomware tabletop exercise scenarios with dynamic injects, decision points, and automated scoring. Start running quarterly ransomware drills in minutes, not weeks.
Related Articles
Ransomware Response Best Practices 2025
Complete guide to ransomware detection, containment, and recovery
Read more →
Why Run Quarterly Tabletop Exercises
The case for frequent incident response training
Read more →
How to Conduct Incident Response Tabletop Exercises
General guide to running effective IR exercises
Read more →