How to Run a Ransomware Tabletop Exercise for Your Australian SMB — A Complete 2-Hour Playbook

Why Tabletop Exercises Matter for SMBs — Not Just Enterprises

Most Australian SMBs carry cyber insurance, have a backup strategy, and maybe even a written incident response plan sitting in a drawer. The gap between having a plan and being able to execute it under pressure is where businesses succeed or fail. Tabletop exercises expose that gap cheaply and safely.

The ACSC's latest advisories confirm that threat actors are not just targeting big corporates. The ClickFix campaign uses fake WordPress captcha prompts to trick staff into running malicious PowerShell commands — a technique that works just as well on a 20-person accounting firm in Melbourne as it does on a government agency. Russian GRU actors are targeting logistics companies — that includes the small freight forwarders and warehouse operators across Australia's supply chain.

Three things a tabletop exercise reveals that a written plan cannot:

1. Decision-making bottlenecks. Who approves the decision to shut down email? Who authorises payment or refuses it? Who talks to the ACSC? If the answer is "the owner" and the owner is overseas, you have a problem.
2. Communication failures. If your primary communication channel is email and email is compromised, how does the incident team coordinate? Most teams discover this gap mid-exercise.
3. Tool and access gaps. Do you have offline copies of your incident response plan, contact lists, and critical credentials? Can your IT provider access systems if the office network is encrypted?

Recommendation: Schedule your first exercise within 30 days. Block two hours. Order lunch. Make it low-stakes — the goal is learning, not performance review.

Running Your Exercise: The 2-Hour Format with Roles and Scenarios

Roles to Assign (5-10 participants)

Role	Who	Responsibility
Facilitator	External consultant or IT lead	Reads scenario injects, tracks time, keeps discussion moving
Incident Commander	Operations manager or GM	Makes go/no-go decisions, coordinates team
IT Lead	Internal IT or MSP contact	Provides technical reality checks (what can we actually do?)
Communications Lead	Marketing or office manager	Manages internal messaging, customer notification, media
Legal/Compliance	External lawyer (dial-in is fine)	Advises on breach notification obligations under Privacy Act
Business Owner/CEO	Managing director	Budget authority, strategic decisions (pay ransom? shut down?)
Note-taker	Admin or EA	Documents decisions, timeline, gaps — critical for the after-action report

The NIST IR Framework Structure for Your Exercise

Run each scenario through these six phases. The facilitator introduces the scenario (Preparation/Detection), then the team works through Containment, Eradication, Recovery, and Lessons Learned in real-time discussion:

1. Preparation — What alerts or indicators would we see? Who notices first?
2. Detection & Analysis — How do we confirm it's real? How do we scope it?
3. Containment — What do we isolate first? What's the blast radius?
4. Eradication — How do we remove the threat actor and close the entry point?
5. Recovery — In what order do we restore systems? How do we verify they're clean?
6. Lessons Learned — What failed? What needs to change in the next 30 days?

Five Scenario Cards for 2026

Scenario 1: Ransomware on the File Server Monday 9:42 AM. Staff report files on the shared drive have odd extensions. A ransom note appears on desktops demanding 2.3 BTC. The backup server is on the same network and shows unusual CPU activity.

Scenario 2: Business Email Compromise with Invoice Fraud Your accounts team forwards an email thread from the CEO requesting an urgent payment of $47,000 to a new supplier. The email looks legitimate — headers show it came from a lookalike domain (yourcompany.com.au vs yourcompnay.com.au). Payment was authorised 20 minutes ago.

Scenario 3: Cloud Misconfiguration Data Leak A researcher notifies you that your AWS S3 bucket containing customer PII (names, emails, Medicare numbers) has been publicly accessible for six weeks. You have 4,200 customers across Australia.

Scenario 4: Insider Threat via Departing Employee Your senior developer gave notice on Friday. Monday morning, USB activity logs show 3.4 GB of data copied. Their access is still active across GitHub, AWS, and your production database.

Scenario 5: Supply Chain Compromise Your managed IT provider notifies you they've been breached. They have administrative access to your Microsoft 365 tenant, all endpoints, and your firewall. You don't know if your environment has been accessed.

Measuring Decision-Making: Scoring Rubric

Score each phase of the exercise on three dimensions using a 1-5 scale:

Dimension	1 (Weak)	3 (Adequate)	5 (Strong)
Speed of decision	No clear decision-maker identified; circular discussion	Decision made after reasonable debate	Clear owner makes timely call with available info
Accuracy of action	Wrong containment action or none proposed	Mostly right but misses second-order effects	Correct priority actions with escalation paths
Communication	No notification plan; ad-hoc updates to stakeholders	Internal comms planned but external gaps	Clear internal, customer, regulator, and media plan

Target score: 36/45 across all six NIST phases. Below 24 means your plan needs significant work before the next exercise in 90 days.

Downloadable Tabletop Exercise Template

Scenario Card Template

SCENARIO: [Title]
DATE/TIME OF DETECTION: [e.g., Tuesday 2:15 PM]
INITIAL INDICATOR: [What triggered awareness]
INJECT 1 (T+0 min): [First situation description]
INJECT 2 (T+15 min): [Complication — e.g., "CEO is unreachable"]
INJECT 3 (T+30 min): [Escalation — e.g., "Media has contacted reception"]
INJECT 4 (T+45 min): [Resolution path — e.g., "Backup integrity confirmed"]
KEY DECISION POINTS:
  - [ ] Do we isolate the network?
  - [ ] Do we notify the ACSC?
  - [ ] Do we engage external IR support?
  - [ ] Do we notify affected customers?
  - [ ] Do we pay the ransom?
EXPECTED OUTCOME: [What good looks like]

After Action Report Template

EXERCISE: [Name]           DATE: [Date]
PARTICIPANTS: [Names and roles]
SCENARIO(S) RUN: [Which scenarios]

SECTION 1: TIMELINE OF EVENTS AND DECISIONS
| Time | Event/Inject | Decision Made | By Whom | Time Taken |

SECTION 2: STRENGTHS IDENTIFIED
1. [What worked well]
2. [What worked well]
3. [What worked well]

SECTION 3: GAPS AND WEAKNESSES
1. [Gap] — Severity: [H/M/L] — Remediation: [Action + Owner + Date]
2. [Gap] — Severity: [H/M/L] — Remediation: [Action + Owner + Date]
3. [Gap] — Severity: [H/M/L] — Remediation: [Action + Owner + Date]

SECTION 4: SCORING SUMMARY
| NIST Phase | Speed | Accuracy | Comms | Total |
| Preparation | /5 | /5 | /5 | /15 |
| Detection | /5 | /5 | /5 | /15 |
| Containment | /5 | /5 | /5 | /15 |
| Eradication | /5 | /5 | /5 | /15 |
| Recovery | /5 | /5 | /5 | /15 |
| Lessons Learned | /5 | /5 | /5 | /15 |
| TOTAL | | | | /90 |

SECTION 5: ACTION ITEMS
| # | Action | Owner | Due Date | Status |

SECTION 6: NEXT EXERCISE
Scheduled date: [90 days out]
Focus area: [Address top gap from this exercise]

FAQ

Conclusion

The threats targeting Australian businesses in 2026 are not theoretical. The ACSC is actively advising on WordPress-based malware campaigns hitting local infrastructure, critical vulnerabilities in cPanel being exploited with a CVSS score of 9.3, and state-sponsored actors breaching Western logistics and technology companies. Your incident response plan is only as good as your team's ability to execute it at 9:42 AM on a Monday when the phone starts ringing.

Start with one two-hour exercise. Use the templates above. Assign roles from your actual team. Run one scenario — the ransomware scenario is the best starting point for most SMBs. Document what you learn. Fix the gaps. Run it again in 90 days. That cycle is how small teams build resilience without enterprise budgets.

Ready to find the gaps in your incident response before an attacker does? Visit consult.lil.business for a free cybersecurity assessment tailored to Australian SMBs — we'll help you design and facilitate your first tabletop exercise.

References

1. ASD ACSC Advisory — ClickFix Distributing Vidar Stealer via WordPress Targeting Australian Infrastructure
2. ASD ACSC Alert — Active Exploitation of cPanel/WHM Critical Vulnerability (CVE-2026-4194)
3. NIST Special Publication 800-61 Rev. 2 — Computer Security Incident Handling Guide
4. ASD ACSC Advisory — Defending Against China-Nexus Covert Networks of Compromised Devices