Ransomware is the scenario that concentrates minds most effectively. When organisations run ransomware tabletop exercises — particularly when executive leadership participates — the exercise consistently produces a level of urgency and engagement that other cyber scenarios do not. Ransomware is concrete, costly, and well-understood enough that its potential impact on the organisation becomes viscerally clear during the exercise in a way that abstract risk discussions never achieve.
It is also, by significant margin, the scenario most likely to actually occur. Running a ransomware tabletop is not a theoretical exercise — it is preparation for a high-probability event.
What a Well-Designed Ransomware Tabletop Covers
A ransomware tabletop exercise designed for executive and board-level participation covers the full response lifecycle — from initial detection through the difficult decisions of the middle phase to recovery and post-incident review. The scenario is structured to test the decisions and capabilities that matter most.
Phase 1: Discovery and initial assessment. The scenario opens with the first indicators of compromise — an alert from the security team, reports of encrypted files from users, or a ransom note appearing on screens. Participants work through: How is the scope of the incident determined? Who is notified and in what sequence? What is the initial containment decision? At this stage, exercises typically reveal that initial scope assessment is slower and more uncertain than incident response plans assume — because the indicators are ambiguous and the full picture is not immediately available.
Phase 2: Escalation and difficult decisions. As the incident develops, the hard decisions emerge. Is law enforcement notified? When are clients informed? The PR team is getting calls from journalists — who speaks and what do they say? The ransom demand arrives — what is the organisation’s position on payment? Is the board convened? What authority does the incident response team have without board approval? This phase tests executive decision-making under pressure and consistently reveals gaps in decision authority, communication protocols, and preparedness for the reputational and legal dimensions of the incident.
Phase 3: Recovery and regulatory response. Recovery timelines prove longer than the DR plan assumed. A regulatory notification deadline is approaching. Which regulators need to be notified and by when? Who drafts the notification? Have the organisation’s ICO notification obligations been met? This phase tests the integration between technical recovery, regulatory compliance, and business continuity — and typically surfaces the gaps between what the plans say and what the organisation can actually execute.
Why Board Participation Is Not Optional
Ransomware incidents require decisions that only board and executive leadership can make: ransom payment decisions, public communications, regulatory notification sign-off, and decisions about which business functions to prioritise in recovery. Running a ransomware tabletop without board and executive participation produces a technically informed exercise with a significant gap in the decision-making dimensions.
Board and executive participation also changes the outcome of the exercise in a valuable way: leadership who have experienced the scenario, even in a facilitated discussion, are qualitatively more prepared to make good decisions under real incident pressure. They have mental models for what the incident looks and feels like. They have thought through their decision criteria before being asked to apply them under stress.
At Bitsecura, we design and facilitate ransomware tabletop exercises for executive and board-level audiences — structured to test the decisions and capabilities that ransomware scenarios actually demand. Our exercises are scenario-specific, injects are realistic, and our facilitation is designed to produce findings rather than validation. If you want to run a ransomware tabletop, talk to us here.
Bitsecura provides cybersecurity tabletop exercise design and facilitation services. Learn more about our tabletop exercise services.