Individual skill
performing-ransomware-tabletop-exercise
Plans and facilitates tabletop exercises simulating ransomware incidents to test organizational readiness, decision-making, and communication procedures. Designs realistic scenarios based on current ransomware threat actors (LockBit, ALPHV/BlackCat, Cl0p), injects covering double extortion, backup destruction, and regulatory notification requirements. Evaluates participant responses against NIST CSF and CISA guidelines. Activates for requests involving ransomware tabletop, incident response exercise, or ransomware readiness drill.
internal/tools/skills/data/ransomware-defense/performing-ransomware-tabletop-exercise/SKILL.md
Source commit d42f381ad34843e71a42658e5c57290c713e85af
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- Yes
- Observed behavior
- Instructions only
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,323
- Repository last updated
- Nov 8, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- cybersecurity Repository topic
- security Repository topic
- bug-bounty Repository topic
- automation Repository topic
- autonomous-pentesting Repository topic
- ai-agent Repository topic
- ai-security Repository topic
- ethical-hacking Repository topic
- golang Repository topic
- penetration-testing Repository topic
- ransomware Declared skill tag
- incident-response Declared skill tag
- tabletop-exercise Declared skill tag
- defense Declared skill tag
- preparedness Declared skill tag
- legal Derived category
- security Derived category
- testing Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 13,037 bytes
Read excerpt
# Performing Ransomware Tabletop Exercise
## When to Use
- Testing organizational ransomware response procedures annually or after major infrastructure changes
- Validating decision-making processes for ransom payment, regulatory notification, and public disclosure
- Training executives, IT, legal, PR, and operations teams on their roles during a ransomware incident
- Meeting cyber insurance policy requirements for documented incident response testing
- Identifying gaps in recovery playbooks, communication plans, and backup procedures
**Do not use** as a substitute for technical controls testing. Tabletop exercises validate procedures and decision-making, not technical detection or prevention capabilities.
## Common Misconfigurations & Verification
- **Scenario doesn't stress the recovery assumptions:** the most common gap is an inject set that never tests what happens when backups are also hit. Build at least one branch where primary backups are encrypted and only the immutable/air-gapped copy survives — that forces the team to confront real RTO and whether `vssadmin delete shadows`-style backup destruction was anticipated.