A library of exercise narratives for teams that have never run a tabletop, or have run the same ransomware one three years in a row. Each scenario is a fictional company, a trigger, a sequence of injects that arrive out of order, and the decisions a team has to make before it knows what it is looking at.
What the scenarios deliberately leave out: your obligations. No notification deadlines, statutes, contract terms or SLA numbers are stated as fact, because a written scenario cannot know your jurisdiction, your customer agreements or your policies. Working those out is part of the exercise. The rubric asks whether the team did; the facilitator says whether they got it right.
Looking for exercise templates and after-action forms instead? Those already exist and are good: CISA Tabletop Exercise Packages, NCSC Exercise in a Box, Backdoors & Breaches Campaigns, NIST SP 800-84 (how to run an exercise).
Scenarios by vector and catalog. A scenario that lists two vectors counts in both. Empty cells are what gets written next.
| Vector | Incident response | Disaster recovery |
|---|---|---|
| Ransomware | 0 | 0 |
| Identity | 0 | 0 |
| AI agent | 1 | 0 |
| Supply chain | 0 | 0 |
| Web application | 1 | 0 |
| Business email compromise | 0 | 0 |
| Insider | 0 | 0 |
| Backups | 0 | 0 |
| Cloud region | 0 | 0 |
| Vendor outage | 0 | 0 |
Organization profiles: Agency or MSP running other people's systems · 1 Health tech, holds patient data · 1
Judgment under partial information: what the team decides in the first ninety minutes, before it knows what it is looking at.
Outside AI agents: automated visitors nobody can identify crawl an agency's client sites, an account nobody remembers approving reconfigures one client's citation tool, and the team cannot say whether any client's data went out through it.
Copperleaf Digital Agency or MSP running other people's systems
Data theft through a forgotten web application: an extortion email arrives with real patient records as samples, nothing is encrypted, nothing is down, and the team cannot say how much is gone.
Quillmont Health Health tech, holds patient data
The plan exists. Now one of its assumptions fails: the backup that was never restored, the failover that depends on the thing that is down.
Scenarios for this catalog are in progress.
we work together 
A complimentary, exploratory meeting to discuss your business goals and challenges, identify potential solutions, and determine if our services align with your needs.
Augmenting a specific initiative or project, leveraging our expertise and resources to deliver a defined outcome.
Ongoing collaboration and support through regular meetings, check-ins, and access to our team's collective knowledge and experience, empowering you to make informed decisions and drive sustained growth.