Live tabletop with technical support
A hybrid tabletop where technical partners fed real-time artifacts to legal and leadership.
- Situation
- An organization with a new security operations provider wanted to test whether IT, legal and leadership could work together during a ransomware attack.
- Approach
- Technical partners injected realistic logs, alerts and a ransom note while IT contained systems and leadership decided on notification, insurer contact and ransom questions, with counsel guiding privilege.
- Outcome
- The drill exposed a gap in after-hours contact lists and evidence preservation. An after-action report set a prioritized remediation roadmap.
Lessons learned
- Privilege should be set up from the first hour
- Evidence preservation needs clear owners
- After-hours contacts must be tested
Illustrative scenario, not a completed client engagement.