7 Incident Response Scenarios Mapped to Injects, Evidence, and AARs

This page delivers a ready-to-run catalog of incident response scenarios, facilitator-ready injects, and templates drawn from CISA, NIST, Atlassian, Microsoft, and PagerDuty. You will find scripted ransomware, phishing, supply-chain, and cloud outage scenarios, each with decision points and evidence to hand your team, plus an after-action review structure to convert findings into fixes.

TL;DR:

Running quarterly tabletop exercises helps identify gaps in detection, decision authority, telemetry accuracy, and communication speed before a real incident occurs.

Simulated scenarios should include specific decision points, evidence, and timelines to produce measurable metrics like detection and containment times.

Use existing templates from CISA, NIST, and Atlassian to streamline scenario development and focus on testing relevant NIST functions such as Detect and Respond.

After-action reviews should track decision latency, detection speed, and playbook gaps, prioritizing fixes based on risk and effort.

Converting scenario scripts into hands-on labs with real telemetry and scoring rubrics enhances team readiness and operational muscle memory.

Why realistic incident response scenarios matter for IR teams
Catalog of realistic incident response scenarios for tabletop exercises
How do you design and run a tabletop exercise?
Authoritative templates worth adapting for your own exercises
After-action review: structure, metrics, and prioritizing fixes
Turning tabletop scripts into hands-on training
Sample scripts you can run this week
Sample scenario discussion questions worth reusing across exercises
What teams consistently get wrong in these exercises
How Total Cyber Academy helps teams operationalize scenarios
Sources

Why realistic incident response scenarios matter for IR teams

Most incident response plans look solid on paper and fall apart under actual pressure. Tabletop exercises expose that gap before an attacker does, because they force people, process, and technology to interact under time constraints instead of sitting isolated in a policy document. A well-built scenario reveals whether your on-call engineer actually knows who can authorize a network segmentation decision at 2 a.m., or whether that authority lives only in someone’s head.

The PagerDuty postmortem on a Kafka outage is a useful reference point here, even though it documents an operational failure rather than an attack. Cascading dependencies and JVM heap exhaustion from a producer creation bug spread through the system while critical alerts got buried under webhook noise. That is exactly the kind of observability blind spot a tabletop exercise should be designed to surface before it happens for real.

CISA and NIST’s Cybersecurity Framework both frame exercises as capability tests, not just compliance checkboxes. Teams should walk away from every session with:

A measured time-to-detect and time-to-contain for the scenario
A list of decisions that stalled because authority was unclear
Gaps between what telemetry the team assumed existed and what actually got produced
Communication delays between technical responders and leadership

Run these quarterly at minimum. Attackers don’t wait for your annual compliance cycle, and neither should your practice sessions.

Catalog of realistic incident response scenarios for tabletop exercises

Every scenario below follows the same skeleton: an objective, a set of injects the facilitator releases in sequence, decision points that force a team choice, evidence to hand players, and a rough timeline. Mix technical and human-centered scenarios across your annual calendar rather than running the same ransomware script every quarter.

Ransomware with data extortion. Objective: test containment speed and executive decision-making under a ransom deadline. Injects include a help desk ticket reporting slow file access, a SOC alert on mass file renames, a ransom note discovered on a shared drive, and a threat actor email threatening data leak. Decision points: isolate affected shares immediately or investigate scope first, and pay or refuse the ransom demand. Telemetry to release: EDR process trees, file-share access logs, and the ransom note text. Expected timeline: 90 to 120 minutes, with the extortion inject arriving midway to raise pressure.
Phishing and business email compromise. Objective: test credential-compromise detection and lateral movement response. Injects should include a phishing email sample, a helpdesk report of MFA fatigue prompts, and increasingly convincing social-engineering attempts. Reports on modern attack trends note a rise in vishing and AI-assisted lures, so include a voice-call inject where an “IT support” caller pressures a help desk agent to reset credentials. Decision points: force a password reset organization-wide or scope to affected accounts, and how to communicate with employees without tipping off the attacker. Evidence: mailbox rule changes, login anomaly logs, and the phishing sample itself. Timeline: 60 to 90 minutes.
Supply-chain and CI/CD compromise. Objective: test detection of a malicious package publish and CI credential theft. Microsoft’s analysis of the Chaindrop supply-chain compromise describes payloads executing through npm preinstall hooks and stealing publishing tokens to propagate further. Build injects around a developer workstation showing unexpected build artifacts, an unscheduled package version publish, and CI logs showing token usage from an unrecognized IP. Decision points: pull the package from the registry immediately or investigate scope first, and whether to rotate all CI credentials organization-wide. Remediation priorities: rotate tokens, purge build caches, and rebuild artifacts from known-good sources. Timeline: 2 to 3 hours given the investigative complexity.
Insider data theft. Objective: test detection of privilege misuse and coordination with HR and legal. Injects: a DLP alert on unusual bulk file downloads, a manager report of an employee’s resignation notice, and inconsistent badge access logs. Decision points: suspend access before or after notifying HR, and how to preserve evidence for potential legal action. Evidence: DLP logs, access control history. Timeline: 2 hours, paced slowly to emphasize the legal sensitivity.
ICS/OT compromise. Objective: test safety-critical escalation paths. Injects: an anomalous PLC command, a facilities report of equipment behaving oddly, and a network segmentation alert. Decision points: halt physical operations or continue monitoring, and when to escalate to engineering versus IT security. Evidence: OT network logs, physical sensor readings. Timeline: 90 minutes, with safety framed as the primary constraint.
DDoS or major cloud outage. Objective: test failover decisions and customer communication. Injects: rising latency alerts, a status page inquiry flood, and a partial service degradation report. Decision points: fail over to backup infrastructure or ride out the surge, and when to post a public status update. Evidence: traffic graphs, load balancer logs. Timeline: 60 minutes.
Cloud account compromise. Objective: test secret rotation speed. Injects: an alert on a service principal accessing unusual resources, a cloud audit log showing new API keys created. Decision points: revoke credentials immediately (risking service disruption) or scope the blast radius first. Evidence: cloud IAM logs, API call history. Timeline: 90 minutes.

How do you design and run a tabletop exercise?

Start with a measurable objective, not a topic. “Test ransomware response” is too vague; “measure time from detection to containment decision, and confirm the on-call engineer knows who can authorize isolation” gives you something to actually score. Map that objective to a NIST CSF function, whether Detect, Respond, or Recover, so you know exactly which capability you’re testing rather than running a generic drill.

Choose your exercise type based on maturity. A discussion-based session, where the facilitator narrates injects and the team talks through decisions, suits teams new to tabletop exercises or complex scenarios like supply-chain compromise. A walkthrough adds live tool access so participants demonstrate actual queries and actions. A full-play exercise injects real (simulated) alerts into live systems and should be reserved for mature teams who have already run several discussion-based sessions.

Before the session, assign roles explicitly:

A decision maker who can authorize containment actions
Technical leads who interpret evidence and propose remediation
A communications or legal representative who drafts external messaging
A facilitator who controls inject pacing and stays outside the response itself

Prepare evidence packets in advance, matching CISA’s approach of supplying situation manuals and slide decks rather than improvising mid-session. Draft your facilitator script with specific inject timing, and decide up front how much time pressure to apply.

Pro Tip: Separate your exercise notification channel from your organization’s real alerting tools. The Kafka postmortem showed how critical signals get buried under webhook noise during real incidents; running a drill inside the same noisy channel teaches the wrong lesson.

Authoritative templates worth adapting for your own exercises

You don’t need to build every exercise asset from scratch. Several organizations publish materials that map directly onto the scenario catalog above.

CISA Tabletop Exercise Packages include situation manuals, slide decks, discussion questions, and After Action Report templates covering ransomware, insider threats, and ICS scenarios. Adapt the module questions to reference your actual tools and team names rather than running them generically.
NIST CSF gives you a five-function structure, Identify, Protect, Detect, Respond, Recover, for setting exercise objectives. Pick one or two functions per exercise rather than trying to test all five in a single session.
Atlassian’s incident communication templates provide pre-drafted language for investigation, partial outage, and full outage stages. Hand these to your comms lead as an inject so they practice adapting a template under pressure instead of drafting from a blank page.
Microsoft’s Chaindrop analysis offers concrete remediation steps, credential rotation, cache purging, and artifact rebuilds, that translate directly into decision-point options for your supply-chain scenario.

After-action review: structure, metrics, and prioritizing fixes

A useful AAR runs longer than a group nod and a “that went fine.” Structure it with an executive summary, a timeline of what happened and when, the decisions made and by whom, the evidence reviewed, a root cause discussion, lessons learned, and action items with named owners and deadlines.

Track a handful of metrics across exercises so you can see whether your team is actually improving:

Time to detect the simulated incident from the first inject
Time to reach the first containment decision
Decision latency at each identified decision point
Number of playbook gaps discovered
Communication lag between technical and leadership tracks

Metric	What it reveals
Time to detect	Telemetry and alerting coverage
Decision latency	Authority clarity in runbooks
Playbook gaps	Documentation completeness
Communication lag	Cross-team coordination speed

Prioritize action items by risk multiplied by effort, tackling high-risk, low-effort fixes first, then schedule a follow-up drill in 60 to 90 days to confirm the fix actually worked.

Turning tabletop scripts into hands-on training

A discussion-based scenario teaches people to talk about a response. It doesn’t teach them to execute one. Total Cyber Academy’s approach to closing that gap starts by taking the same script, the ransomware scenario’s file-encryption injects, for example, and rebuilding it inside a live lab environment where students interact with real EDR telemetry, actual log files, and a simulated ransom note rather than a slide describing one.

Converting a script into a lab requires three components: an isolated environment where actions have consequences, telemetry injected on a timeline that mirrors the tabletop pacing, and a scoring rubric that grades specific analyst actions, not just a final answer. A student who isolates the wrong subnet first should see that mistake reflected in a worse containment time, the same way a real SOC analyst would.

Facilitator materials matter just as much in a hands-on setting as in a discussion room. Runbooks need to specify expected analyst actions at each stage, evidence packets need to match what a real SOC toolchain would surface, and assessment checklists need to score against those specifics rather than vague impressions of effort.

Total Cyber Academy builds its hands-on cybersecurity training programs around exactly this conversion, pulling from real-world scenario patterns rather than abstract theory. Students working toward certification exams still need a baseline of prerequisite skills before tackling a full incident simulation. Reviewing a training prerequisites checklist first helps identify where those gaps sit before a student walks into a live-fire lab.

Pro Tip: If you’re building your own lab conversion, start with the decision points, not the injects. A scenario with three clean decision points and rough telemetry teaches more than one with perfect telemetry and a vague choice at the end.

Sample scripts you can run this week

Below are three condensed scripts you can facilitate with minimal prep. Each includes an inject sequence, key evidence, and discussion questions to run after the scenario closes.

Ransomware script. Inject sequence: (1) help desk reports slow file access, (2) SOC flags mass file renames, (3) a department head reports a ransom note on a shared drive, (4) a threat actor email arrives threatening data leak in 48 hours. Evidence: the ransom note text, EDR alert timestamps, file-share access logs. Discussion questions: Who has authority to isolate the shares? What is your position on paying? How do you notify customers if data was exfiltrated? What backup restoration path exists? How long would full restoration actually take? Who briefs leadership and when?
Supply-chain compromise script. Inject sequence: (1) a developer notices an unexpected build artifact on their workstation, (2) the package registry shows an unscheduled version publish, (3) CI logs reveal token usage from an unrecognized IP address. Evidence: CI build logs, package registry timestamps, workstation process history. Remediation priorities to discuss: rotating all CI tokens, purging build caches, rebuilding from known-good sources. Questions: Do you pull the package immediately or investigate scope first? Who has authority to revoke CI credentials? How do you notify downstream consumers of the compromised package?
BEC and executive impersonation script. Inject sequence: (1) a suspicious login alert from an unfamiliar country, (2) a finance employee reports a forwarded email requesting an urgent wire transfer, (3) DLP flags an unusual email forwarding rule. Evidence: login anomaly logs, the forwarded email, the forwarding rule configuration. Questions: How do you verify the wire request before it processes? Who contacts legal, and when? How do you determine what data left the mailbox?

Run a facilitator checklist before each session: confirm roles are assigned, evidence packets are printed or staged, inject timing is scripted, and someone owns the AAR notes from the first minute.

Sample scenario discussion questions worth reusing across exercises

A handful of discussion questions work across nearly every scenario type, and keeping a standing list saves you from writing new ones for every session. Ask who had the authority to make the key containment decision, and whether that person was actually in the room, or reachable, during the exercise. Ask what evidence the team wished they had access to but didn’t. That question alone tends to surface more telemetry gaps than any technical review.

Ask how the team would have communicated with customers or the public if the incident had run two hours longer, and whether the pre-drafted templates they had on hand actually matched the situation once modified. Ask what would have happened if the incident occurred at 3 a.m. on a Saturday instead of during business hours, since on-call staffing and escalation paths often look different on paper than they do in practice.

For scenarios involving external attackers, always ask what a regulator or legal counsel would want to know within the first hour. That question forces teams to think beyond technical containment toward the reporting obligations that often determine how an incident is judged after the fact. Close every session by asking the group to name the single decision point that felt most uncertain, since that answer usually points straight to the highest-priority fix for your next AAR.

What teams consistently get wrong in these exercises

The most common failure isn’t a missing runbook. It’s alert fatigue: critical signals get buried under low-priority notifications until nobody trusts the alerting system enough to act fast. The second is ambiguous authority. Teams argue about who can pull the trigger on containment instead of executing, because the runbook names a role instead of a person with a phone number.

Fix both before your next exercise. Separate your critical alert channel from noisy secondary streams, and write runbooks that name specific decision-makers, not just titles.

— Alden

How Total Cyber Academy helps teams operationalize scenarios

Reading a scenario script builds awareness. Running one under exam-style conditions, with real telemetry and a graded rubric, builds the muscle memory a live incident actually demands. That’s the gap between a tabletop discussion and a job-ready skill set, and it’s the gap Total Cyber Academy’s programs are built to close.

Total Cyber Academy maps its hands-on labs directly to the kind of runbooks and evidence packets described throughout this catalog: ransomware containment, phishing triage, cloud credential response, and more, each scored against specific analyst actions rather than a final multiple-choice answer. Programs combine live mentoring, exam preparation for CompTIA, EC-Council, and ISC2 certifications, and lab environments where mistakes carry consequences instead of just feedback. If you’re a veteran, career changer, or IT professional looking to turn scenario literacy into a credentialed skill set, Total Cyber Academy’s training programs walk through course options and how they map to real incident response roles. Explore the current course catalog and request details on the next workshop cohort to see where your team’s gaps actually sit.