agendIQ
TemplatesPricing
Sign inStart free

Product

  • Agenda builder
  • Live meetings
  • Video calls
  • Presentations
  • Team and calendar
  • Notes for everyone

Free tools

  • Agenda maker
  • Online timer
  • Wheel spinner
  • Team generator
  • Word cloud generator
  • AI quiz generator
  • Meeting cost calculator
  • Meeting games
  • Guides
  • All free tools
  • Templates
  • Pricing
Sign inStart free

Free forever · Pro free for 14 days. No card needed.

  1. Home/
  2. Templates/
  3. Workshops/
  4. Cybersecurity tabletop exercise
WorkshopIT & securitySafety

Cybersecurity tabletop exercise

120 minutes 8 blockspro Runs with Pro

A ransomware tabletop: timed injects from detection to press call, responses by role across detect, communicate, decide and recover, and the gaps to fix.

Use this template See inside

Free to open and edit. Running it live needs Pro, free for 14 days on every new account.

Share
Contain
Detect and contain: check, isolate, shut down
Communicate
Who do we tell, when, and how?
Decide
Which decisions, and who has the authority?
Recover
Restore, verify, reopen
Gaps
Where our plan, tools or access fall short

In short

A cybersecurity tabletop exercise is a discussion-based rehearsal of how a team would respond to a cyber incident such as ransomware. This template runs a two-hour session with three timed injects, responses by role from everyone's phone across detect, communicate, decide and recover, a discussion of the hard decisions and owned fixes.
Time
2 hours
People
5 to 20
Board
5 columns, 3 dots each
Plan
Pro

Updated October 4, 2026

What's inside

The agenda

By the end of this meeting, we've tested our incident response plan against a ransomware scenario and have prioritized fixes with owners.

120 min · 8 blocks, drawn to scale Fits exactly
  1. Objectives, roles and ground rules, 8 minutes 8
  2. Scenario: Monday, 07:40, 7 minutes 7
  3. Injects 1 to 3: respond by role, 50 minutesBrainstorm 50
  4. Break, 10 minutes 10
  5. The hard decisions, 20 minutesDiscuss 20
  6. Dot-vote the biggest gaps, 5 minutes 5
  7. Improvement actions, owners and dates, 12 minutes 12
  8. Hotwash and the next exercise date, 8 minutes 8
0306090120 min
  1. +0′Objectives, roles and ground rulesTip: Confirm who plays which role: incident lead, IT and security, legal, communications, an executive decision-maker. No-fault: we're testing the plan.8 minInfo
  2. +8′Scenario: Monday, 07:40Tip: Starting situation: the service desk gets three calls about files that won't open and an unfamiliar text file on a shared drive. Adapt it to your own systems.7 minInfo
  3. +15′Injects 1 to 3: respond by roleTip: Inject 1 at minute 0: the calls above. Inject 2 at minute 15: a ransom note claims data was copied out and sets a 72-hour deadline. Inject 3 at minute 30: a journalist calls and a major customer asks if their data is safe. Four minutes of silent responses each, then discussion.50 minBrainstorm
  4. +65′Break10 minBreak
  5. +75′The hard decisionsTip: Do we take systems offline? When do we notify regulators, insurers, customers and law enforcement? Who decides on a ransom demand? Check your plan and your legal duties; notification deadlines differ by law and region.20 minDiscuss
  6. +95′Dot-vote the biggest gapsTip: Three dots each. Out-of-band communication, backup restore times and contact lists are common finds.5 minDiscuss
  7. +100′Improvement actions, owners and dates12 minDecide
  8. +112′Hotwash and the next exercise dateHow confident are you in our response now? 1 to 58 minWrap-up

How to run it

  1. 1Invite decision-makers, not just IT: legal, communications and an executive make the exercise real.
  2. 2Adapt the scenario to your own systems and reveal one inject every 15 minutes. Everyone answers by role from their phone.
  3. 3Spend real time on the hard decisions: shutting systems down, notifications and a ransom demand.
  4. 4Dot-vote the gaps, give each fix an owner and a date, and book the next exercise. Testing at least once a year is a common expectation.

Questions people ask

What is a cybersecurity tabletop exercise?
A facilitated session where IT, security, legal, communications and leadership talk through a realistic cyber incident step by step, to test the incident response plan and find gaps before a real attack.
What is a ransomware tabletop exercise example?
Files stop opening on a Monday morning; a ransom note then claims data was stolen and sets a deadline; later a journalist calls. At each step the team decides what to contain, who to tell and who decides.
How often should you run an incident response tabletop exercise?
At least once a year, and after major changes to systems, staff or the plan. NIST SP 800-84 gives guidance on testing and exercise programs for IT plans.
Who should take part?
The incident lead, IT and security, legal or compliance, communications, and an executive who can make business decisions. Add key suppliers if they'd be part of the response.

Run it with your group

pro
  • Ideas land on the board from every phone, then dot-vote
  • A timer for every block on the shared screen
  • Results, decisions and actions in the summary
Use this template

Free to open and edit. Running it live needs Pro, free for 14 days on every new account.

Goes well with

All workshops
  • Strengths
    Improve
    Gaps and surprises
    For the AAR
    proWorkshop·Government & councils
    Hotwash debriefThe immediate debrief after an exercise or incident: strengths, areas for improvement and gaps from every responder's phone, ready for the after-action report. 30 min

  • Cybersecurity awareness month

    Four weeks, four habits, 30 minutes each

    proMeeting kit·IT & security
    Cybersecurity awareness month kitFour 30-minute weekly sessions for October: passwords, MFA, phishing (with a test debrief) and updates, each with scenario polls on phones. 30 min 16 slides
  • Now
    Next
    Later
    Retire
    Risks and debt
    proWorkshop·IT & security
    IT roadmap planningPlan the technology roadmap with the business: initiatives by horizon, systems to retire, and risks like end-of-support and tech debt in plain view. 90 min
  • Deviation
    Causes
    Consequences
    Safeguards
    Actions
    proWorkshop·Construction
    HAZOP workshopWork node by node through guideword deviations, with causes, consequences, safeguards and actions captured live from the whole team. 120 min
  • Inject 1
    Inject 2
    Inject 3
    Gaps in our plan
    proWorkshop·Government & councils
    Emergency tabletop exerciseRun a discussion-based emergency exercise: three timed injects, responses by role from every phone, a gap vote and an improvement plan with owners. 120 min
  • Safety today
    New ideas
    In progress
    Done
    proWorkshop·Healthcare
    Unit huddle boardA 15-minute daily huddle with a live board: safety concerns and ideas from every phone, in-progress improvements and a done column worth celebrating. 15 min

  • Security awareness training

    Phishing, passwords, MFA and the everyday habits attackers count on us to skip

    proPresentation·IT & security
    Security awareness training presentationAnnual security awareness in 35 minutes: phishing red flags, passphrases, MFA prompts and what to do if you clicked, built on scenario polls. 35 min 14 slides
  • Plan and watch
    Act now
    Accept and monitor
    Reduce cheaply
    proWorkshop·Any team
    Risk register workshopCollect risks from the whole team, place them together on a likelihood and impact grid, then give each serious one a response, an owner and a review date. 60 min

Open it, make it yours, run it live.

Change anything in the editor. When you're ready, press Present: everyone joins with a scan and answers on their phone.

  • Free forever
  • Pro free for 14 days
  • No card needed
  • Guests never need an account
Use this template More workshops
agendIQ

Meetings are boring. Let's make them fun. Plan the agenda, run it live with a call that follows it, and leave with decisions.

Product

  • Plan a meeting
  • How it works
  • Video calls
  • Interactive presentations
  • Meeting timer
  • Pricing
  • Join with a code
  • Sign in

Templates

  • Presentation templates
  • Games & quizzes
  • Workshop templates
  • Meeting kits
  • Weekly team meeting agenda
  • Retrospective meeting agenda
  • 1:1 meeting agenda
  • All 507 templates

Free tools

  • AI agenda maker
  • Meeting cost calculator
  • Video meetings
  • All free tools
  • Online timer
  • Wheel spinner
  • Random team generator
  • Word cloud generator
  • AI quiz generator

Guides

  • Meeting games & icebreakers
  • How to write a meeting agenda
  • How to run effective meetings
  • Meeting minutes & action items

Compare

  • Mentimeter alternative
  • Slido alternative
  • Free video calls compared
  • Google Meet alternative
  • Zoom alternative
  • Miro alternative
  • Otter.ai alternative
  • Kahoot alternatives
  • Gamma alternative

Trust

  • Privacy Policy
  • Terms of Service
  • Calls are never recorded
  • Votes stay anonymous
  • Data stored in the EU
© 2026 Agendiq30 sectors · 507 templates · Participants never need an account