Scenario Catalog

100 TTX Exercises

Click any card · hover to pause

RansomwareAdvanced

Hospital Network Encryption

EMR systems offline. Patient diversion decisions required under HIPAA breach clock. Tests clinical continuity and vendor coordination under operational pressure.

RansomwareAdvanced

MSP Supply Chain Attack

RMM tool compromise hits multiple clients simultaneously. Tests multi-client triage, notification obligations, and reputational damage control.

RansomwareAdvanced

Manufacturing OT/IT Convergence

IT ransomware spreads to OT network. Production halted. Safety system integrity unknown. Tests IT/OT segmentation failures and restart authority.

RansomwareExpert

Energy Utility SCADA Threat

Ransomware adjacent to SCADA. NERC CIP obligations, CISA notification, and grid isolation decision under uncertainty.

RansomwareAdvanced

Regional Bank Core Systems

Core banking encrypted. Wire processing halted. FFIEC/OCC regulatory notification and customer service crisis simultaneously.

RansomwareAdvanced

Law Firm Double Extortion

Client files encrypted AND exfiltrated. Attorney-client privilege at risk. Bar association notification question.

RansomwareIntermediate

School District Student PII

Student records encrypted and threatened for public release. FERPA obligations, parent comms, and media pressure build simultaneously.

RansomwareAdvanced

Pharma Clinical Trial Data

Active clinical trial database encrypted mid-study. FDA 21 CFR Part 11 obligations and patient safety implications.

Business Email CompromiseIntermediate

AP Wire Fraud — $480K

DocuSign phishing → M365 credential harvest → fraudulent $480K wire. Stop-payment window closing. First-15-min BEC playbook under time pressure.

Business Email CompromiseAdvanced

Deepfake CEO Video Call

CFO receives convincing deepfake video call from 'CEO.' $2.3M wire authorized before detection. Tests out-of-band verification procedures.

Business Email CompromiseAdvanced

Law Firm Trust Account Fraud

Client escrow wire redirected. State bar and malpractice insurer notifications required. Legal ethics obligations under breach.

Business Email CompromiseIntermediate

Vendor Invoice Fraud — 3 Months

Long-term vendor banking details changed 3 months ago. Unknown amount diverted. Multi-month AP fraud scoping and audit trail reconstruction.

Business Email CompromiseBeginner

HR Payroll Redirect

Attacker redirects employee direct deposit to mule account. Discovered on payday. Payroll fraud response and employee notification obligations.

Insider ThreatAdvanced

Departing Engineer — Code Exfiltration

Bulk repo clone + personal GitHub push during notice period. IP theft confirmed post-departure. Tests insider threat response and offboarding control gaps.

Insider ThreatAdvanced

DBA Pre-Termination Exfiltration

Database admin extracts full customer PII before layoff announcement. Privileged access revocation, litigation risk, and legal hold procedures.

Insider ThreatAdvanced

Research Scientist Data Theft

Pharma researcher exfiltrates pre-publication trial data to a foreign institution. Export control (EAR), NIH reporting, and academic misconduct implications.

Insider ThreatBeginner

Healthcare Worker Patient Snooping

Nurse accesses celebrity patient records without clinical need. HIPAA minimum necessary standard, workforce sanction analysis, and media inquiry.

Insider ThreatAdvanced

Disgruntled Admin Sabotage

Sysadmin deletes production backups and alters configurations before resignation. Sabotage recovery, backup integrity, and admin access control review.

Data BreachExpert

Nation-State IP Theft — 18 Months

APT actor exfiltrated R&D data for 18 months. FBI contacted. Attribution partially confirmed. Expert-level scope assessment and mandatory disclosure.

Data BreachAdvanced

SEC Material Disclosure Decision

Public company breach. 4-business-day Form 8-K clock. Materiality determination contested internally. Tests legal privilege under disclosure pressure.

Data BreachAdvanced

GDPR Cross-Border Breach

SaaS platform breach affects EU customers. 72-hour GDPR supervisory authority notification required. Tests GDPR Article 33/34 and DPA coordination.

Data BreachIntermediate

Healthcare PHI — Third-Party Vendor

Business associate breached. 50,000 patients exposed. HIPAA BAA obligations, HHS OCR coordination, and 60-day notification clock.

Data BreachAdvanced

Payment Card Breach — PCI Scope

Card data compromised at POS. Card brand notification (Visa/Mastercard) required. QFI forensic investigation mandated.

Cloud & InfrastructureAdvanced

Azure AD Global Admin Compromise

Global admin credentials compromised. Full M365 tenant blast radius. Containment without self-lockout and Conditional Access triage.

Cloud & InfrastructureAdvanced

CI/CD Pipeline Poisoning

Malicious code injected into build pipeline. Potentially deployed across 3 microservices. Pipeline compromise scoping and customer disclosure decision.

Cloud & InfrastructureAdvanced

VPN Zero-Day Exploitation

Critical zero-day exploited before patch available. All remote access at risk. Shutdown decision and business continuity tradeoffs under uncertainty.

Cloud & InfrastructureAdvanced

AWS Root Account Compromise

AWS root credentials exposed in public GitHub repo. 6-hour unknown access window. CloudTrail audit, resource assessment, and credential rotation.

Cloud & InfrastructureAdvanced

Kubernetes Escape to Production

Container escape → lateral movement into production database. Dev and SecOps split on response ownership and containment authority.

Social EngineeringBeginner

IT Help Desk Vishing

Attacker impersonates employee, convinces help desk to reset MFA. C-suite account compromised. Identity verification procedures and callback workflow.

Social EngineeringIntermediate

Physical Tailgating + USB Drop

Attacker gains data center access via tailgating. Malicious USB deployed on workstation. Combined physical and digital incident response.

Social EngineeringIntermediate

Multi-Channel Coordinated Phishing

Simultaneous phone + email + SMS campaign targeting 5 executives. Two credentials harvested. Multi-vector response and exposure assessment.

Compliance & RegulatoryIntermediate

HIPAA OCR Audit Trigger

HHS OCR audit letter received following a reported breach. 10-day response window. Document production readiness and workforce interview preparation.

Compliance & RegulatoryAdvanced

CMMC Assessment Failure

C3PAO identifies CMMC Level 2 gaps. DoD contract at risk. POA&M required. Contracting officer notification and contract continuity decisions.

Compliance & RegulatoryIntermediate

NY DFS Cybersecurity Regulation Audit

23 NYCRR 500 examiner requests cybersecurity program documentation. Tests program documentation gaps and examiner briefing.

Compliance & RegulatoryAdvanced

FTC Data Security Investigation

FTC Civil Investigative Demand received following public breach disclosure. Legal hold, CID response, and consent decree risk assessment.

Compliance & RegulatoryIntermediate

SOX IT Control Failure

External auditor identifies material weakness in IT general controls. 10-K filing timeline at risk. SOX ITGC remediation and auditor communication.

OT / ICSExpert

Water Treatment SCADA Intrusion

Unauthorized SCADA access. Chemical dosing levels modified. Public safety risk. CISA/FBI notification and media communication under uncertainty.

OT / ICSExpert

Pipeline Control System Ransomware

Ransomware in pipeline OT network. TSA Security Directive 12-hour notification. CISA coordination and operational shutdown decision — Expert level.

OT / ICSAdvanced

Hospital Medical Device Compromise

Networked infusion pumps showing anomalous behavior. Patient safety and FDA MDR reporting implicated. Device isolation vs. clinical need decision.

OT / ICSAdvanced

Pharma Manufacturing Process Attack

Process control system anomalies during batch production. FDA cGMP deviation reporting, batch integrity assessment, and product recall decision.

Financial ServicesExpert

SWIFT Fraudulent Transaction

$9M in unauthorized SWIFT transfers. Customer Security Programme violation. Correspondent bank engagement, SAR filing, and sanctions risk.

Financial ServicesIntermediate

ATM Jackpotting Attack

$1.2M dispensed across 14 ATMs overnight. Secret Service coordination, network-wide ATM vulnerability assessment, and customer impact notification.

Financial ServicesAdvanced

Crypto Exchange Wallet Compromise

$15M in crypto assets at risk. Hot wallet private keys compromised. Cold storage migration, FinCEN SAR filing, and customer fund protection.

Financial ServicesAdvanced

BSA/AML Program Failure

FinCEN examination reveals BSA/AML program gaps. Consent order and civil money penalty at risk. Remediation plan and consent order negotiation.

Financial ServicesIntermediate

Bank Credential Stuffing Campaign

Large-scale credential stuffing against online banking portal. 3,200 accounts accessed. FFIEC authentication guidance response and customer remediation.

HealthcareExpert

Ransomware — Ambulance Diversion

Hospital encryption forces ambulance diversion. Patient harm potential. Joint Commission notification and clinical downtime procedures under life-safety pressure.

HealthcareAdvanced

EHR Vendor Breach — Multi-Hospital

Cloud EHR vendor breached. 340,000 patients across 12 hospitals. Multi-entity HIPAA response, shared BAA obligations, and ONC coordination.

HealthcareAdvanced

42 CFR Part 2 Substance Use Data

Substance use disorder treatment records inadvertently disclosed. Stricter 42 CFR Part 2 protections beyond HIPAA. Patient consent analysis and DOJ notification.

HealthcareIntermediate

Telehealth Platform Data Exposure

Telehealth video platform misconfiguration exposes session recordings including mental health visits. HIPAA, mental health data sensitivity, and patient notification.

Third-Party / Supply ChainExpert

SolarWinds-Style Software Update

Trusted software update delivers backdoor. Network-wide compromise scope unknown for weeks. Threat hunting across estate and government notification.

Third-Party / Supply ChainAdvanced

Payment Processor Compromise

Payment processor breached. All merchants potentially in PCI scope. Scope expansion, card brand notification, and merchant liability analysis.

Third-Party / Supply ChainIntermediate

Open Source Dependency Compromise

Widely-used npm package compromised with malicious code. Used across 8 internal applications. SBOM gap analysis and patched version deployment.

Third-Party / Supply ChainIntermediate

Legal Outside Counsel Breach

Outside counsel law firm breached. Privileged M&A strategy documents potentially exposed. Privilege waiver risk, affected matters notification, and counsel substitution.

Third-Party / Supply ChainExpert

SS7 Telecom Protocol Attack

SS7 protocol exploited to intercept SMS MFA tokens for high-value banking customers. Customer notification and authenticator app migration acceleration.

RansomwareAdvanced

Hospital Network Encryption

EMR systems offline. Patient diversion decisions required under HIPAA breach clock. Tests clinical continuity and vendor coordination under operational pressure.

RansomwareAdvanced

MSP Supply Chain Attack

RMM tool compromise hits multiple clients simultaneously. Tests multi-client triage, notification obligations, and reputational damage control.

RansomwareAdvanced

Manufacturing OT/IT Convergence

IT ransomware spreads to OT network. Production halted. Safety system integrity unknown. Tests IT/OT segmentation failures and restart authority.

RansomwareExpert

Energy Utility SCADA Threat

Ransomware adjacent to SCADA. NERC CIP obligations, CISA notification, and grid isolation decision under uncertainty.

RansomwareAdvanced

Regional Bank Core Systems

Core banking encrypted. Wire processing halted. FFIEC/OCC regulatory notification and customer service crisis simultaneously.

RansomwareAdvanced

Law Firm Double Extortion

Client files encrypted AND exfiltrated. Attorney-client privilege at risk. Bar association notification question.

RansomwareIntermediate

School District Student PII

Student records encrypted and threatened for public release. FERPA obligations, parent comms, and media pressure build simultaneously.

RansomwareAdvanced

Pharma Clinical Trial Data

Active clinical trial database encrypted mid-study. FDA 21 CFR Part 11 obligations and patient safety implications.

Business Email CompromiseIntermediate

AP Wire Fraud — $480K

DocuSign phishing → M365 credential harvest → fraudulent $480K wire. Stop-payment window closing. First-15-min BEC playbook under time pressure.

Business Email CompromiseAdvanced

Deepfake CEO Video Call

CFO receives convincing deepfake video call from 'CEO.' $2.3M wire authorized before detection. Tests out-of-band verification procedures.

Business Email CompromiseAdvanced

Law Firm Trust Account Fraud

Client escrow wire redirected. State bar and malpractice insurer notifications required. Legal ethics obligations under breach.

Business Email CompromiseIntermediate

Vendor Invoice Fraud — 3 Months

Long-term vendor banking details changed 3 months ago. Unknown amount diverted. Multi-month AP fraud scoping and audit trail reconstruction.

Business Email CompromiseBeginner

HR Payroll Redirect

Attacker redirects employee direct deposit to mule account. Discovered on payday. Payroll fraud response and employee notification obligations.

Insider ThreatAdvanced

Departing Engineer — Code Exfiltration

Bulk repo clone + personal GitHub push during notice period. IP theft confirmed post-departure. Tests insider threat response and offboarding control gaps.

Insider ThreatAdvanced

DBA Pre-Termination Exfiltration

Database admin extracts full customer PII before layoff announcement. Privileged access revocation, litigation risk, and legal hold procedures.

Insider ThreatAdvanced

Research Scientist Data Theft

Pharma researcher exfiltrates pre-publication trial data to a foreign institution. Export control (EAR), NIH reporting, and academic misconduct implications.

Insider ThreatBeginner

Healthcare Worker Patient Snooping

Nurse accesses celebrity patient records without clinical need. HIPAA minimum necessary standard, workforce sanction analysis, and media inquiry.

Insider ThreatAdvanced

Disgruntled Admin Sabotage

Sysadmin deletes production backups and alters configurations before resignation. Sabotage recovery, backup integrity, and admin access control review.

Data BreachExpert

Nation-State IP Theft — 18 Months

APT actor exfiltrated R&D data for 18 months. FBI contacted. Attribution partially confirmed. Expert-level scope assessment and mandatory disclosure.

Data BreachAdvanced

SEC Material Disclosure Decision

Public company breach. 4-business-day Form 8-K clock. Materiality determination contested internally. Tests legal privilege under disclosure pressure.

Data BreachAdvanced

GDPR Cross-Border Breach

SaaS platform breach affects EU customers. 72-hour GDPR supervisory authority notification required. Tests GDPR Article 33/34 and DPA coordination.

Data BreachIntermediate

Healthcare PHI — Third-Party Vendor

Business associate breached. 50,000 patients exposed. HIPAA BAA obligations, HHS OCR coordination, and 60-day notification clock.

Data BreachAdvanced

Payment Card Breach — PCI Scope

Card data compromised at POS. Card brand notification (Visa/Mastercard) required. QFI forensic investigation mandated.

Cloud & InfrastructureAdvanced

Azure AD Global Admin Compromise

Global admin credentials compromised. Full M365 tenant blast radius. Containment without self-lockout and Conditional Access triage.

Cloud & InfrastructureAdvanced

CI/CD Pipeline Poisoning

Malicious code injected into build pipeline. Potentially deployed across 3 microservices. Pipeline compromise scoping and customer disclosure decision.

Cloud & InfrastructureAdvanced

VPN Zero-Day Exploitation

Critical zero-day exploited before patch available. All remote access at risk. Shutdown decision and business continuity tradeoffs under uncertainty.

Cloud & InfrastructureAdvanced

AWS Root Account Compromise

AWS root credentials exposed in public GitHub repo. 6-hour unknown access window. CloudTrail audit, resource assessment, and credential rotation.

Cloud & InfrastructureAdvanced

Kubernetes Escape to Production

Container escape → lateral movement into production database. Dev and SecOps split on response ownership and containment authority.

Social EngineeringBeginner

IT Help Desk Vishing

Attacker impersonates employee, convinces help desk to reset MFA. C-suite account compromised. Identity verification procedures and callback workflow.

Social EngineeringIntermediate

Physical Tailgating + USB Drop

Attacker gains data center access via tailgating. Malicious USB deployed on workstation. Combined physical and digital incident response.

Social EngineeringIntermediate

Multi-Channel Coordinated Phishing

Simultaneous phone + email + SMS campaign targeting 5 executives. Two credentials harvested. Multi-vector response and exposure assessment.

Compliance & RegulatoryIntermediate

HIPAA OCR Audit Trigger

HHS OCR audit letter received following a reported breach. 10-day response window. Document production readiness and workforce interview preparation.

Compliance & RegulatoryAdvanced

CMMC Assessment Failure

C3PAO identifies CMMC Level 2 gaps. DoD contract at risk. POA&M required. Contracting officer notification and contract continuity decisions.

Compliance & RegulatoryIntermediate

NY DFS Cybersecurity Regulation Audit

23 NYCRR 500 examiner requests cybersecurity program documentation. Tests program documentation gaps and examiner briefing.

Compliance & RegulatoryAdvanced

FTC Data Security Investigation

FTC Civil Investigative Demand received following public breach disclosure. Legal hold, CID response, and consent decree risk assessment.

Compliance & RegulatoryIntermediate

SOX IT Control Failure

External auditor identifies material weakness in IT general controls. 10-K filing timeline at risk. SOX ITGC remediation and auditor communication.

OT / ICSExpert

Water Treatment SCADA Intrusion

Unauthorized SCADA access. Chemical dosing levels modified. Public safety risk. CISA/FBI notification and media communication under uncertainty.

OT / ICSExpert

Pipeline Control System Ransomware

Ransomware in pipeline OT network. TSA Security Directive 12-hour notification. CISA coordination and operational shutdown decision — Expert level.

OT / ICSAdvanced

Hospital Medical Device Compromise

Networked infusion pumps showing anomalous behavior. Patient safety and FDA MDR reporting implicated. Device isolation vs. clinical need decision.

OT / ICSAdvanced

Pharma Manufacturing Process Attack

Process control system anomalies during batch production. FDA cGMP deviation reporting, batch integrity assessment, and product recall decision.

Financial ServicesExpert

SWIFT Fraudulent Transaction

$9M in unauthorized SWIFT transfers. Customer Security Programme violation. Correspondent bank engagement, SAR filing, and sanctions risk.

Financial ServicesIntermediate

ATM Jackpotting Attack

$1.2M dispensed across 14 ATMs overnight. Secret Service coordination, network-wide ATM vulnerability assessment, and customer impact notification.

Financial ServicesAdvanced

Crypto Exchange Wallet Compromise

$15M in crypto assets at risk. Hot wallet private keys compromised. Cold storage migration, FinCEN SAR filing, and customer fund protection.

Financial ServicesAdvanced

BSA/AML Program Failure

FinCEN examination reveals BSA/AML program gaps. Consent order and civil money penalty at risk. Remediation plan and consent order negotiation.

Financial ServicesIntermediate

Bank Credential Stuffing Campaign

Large-scale credential stuffing against online banking portal. 3,200 accounts accessed. FFIEC authentication guidance response and customer remediation.

HealthcareExpert

Ransomware — Ambulance Diversion

Hospital encryption forces ambulance diversion. Patient harm potential. Joint Commission notification and clinical downtime procedures under life-safety pressure.

HealthcareAdvanced

EHR Vendor Breach — Multi-Hospital

Cloud EHR vendor breached. 340,000 patients across 12 hospitals. Multi-entity HIPAA response, shared BAA obligations, and ONC coordination.

HealthcareAdvanced

42 CFR Part 2 Substance Use Data

Substance use disorder treatment records inadvertently disclosed. Stricter 42 CFR Part 2 protections beyond HIPAA. Patient consent analysis and DOJ notification.

HealthcareIntermediate

Telehealth Platform Data Exposure

Telehealth video platform misconfiguration exposes session recordings including mental health visits. HIPAA, mental health data sensitivity, and patient notification.

Third-Party / Supply ChainExpert

SolarWinds-Style Software Update

Trusted software update delivers backdoor. Network-wide compromise scope unknown for weeks. Threat hunting across estate and government notification.

Third-Party / Supply ChainAdvanced

Payment Processor Compromise

Payment processor breached. All merchants potentially in PCI scope. Scope expansion, card brand notification, and merchant liability analysis.

Third-Party / Supply ChainIntermediate

Open Source Dependency Compromise

Widely-used npm package compromised with malicious code. Used across 8 internal applications. SBOM gap analysis and patched version deployment.

Third-Party / Supply ChainIntermediate

Legal Outside Counsel Breach

Outside counsel law firm breached. Privileged M&A strategy documents potentially exposed. Privilege waiver risk, affected matters notification, and counsel substitution.

Third-Party / Supply ChainExpert

SS7 Telecom Protocol Attack

SS7 protocol exploited to intercept SMS MFA tokens for high-value banking customers. Customer notification and authenticator app migration acceleration.

TABLETOP EXERCISE INTELLIGENCE

Design exercises that
actually work.

Ask anything about TTX design, facilitation, scenario building, and after-action reviews. Or use the Scenario Builder to generate a complete exercise packet.

Scenario Builder

Generate a full exercise packet — narrative, injects, roles, debrief guide

→

Design exercises thatactually work.

Design exercises that
actually work.