{"id":"sec-it-tabletop-ransomware-injects","audience":"it-security","category":"security","track":"security","technique":"context","title":"Plan the injects for a 60-minute ransomware tabletop","free":false,"task":"Plan the injects for next week's 60-minute ransomware tabletop. Write exactly 5 numbered injects like '1. T+5 min - [Role]: event. Question: ...', with times going up and all under 60 minutes. Each inject is addressed to one person on the roster by role. Doug (CFO) leaves at the 30-minute mark, so any inject for him comes before T+30. Plain text, under 160 words.","materialLabel":"Planning notes (attached to your prompt automatically)","material":"Tabletop planning notes - Kestrel Logistics (fictional), Oct 30\n\nScenario: ransomware hits the warehouse scheduling server on a Monday morning. Ransom note asks for payment within 48 hours.\n\nRoster:\n- Maya Lin - IT Lead\n- Ben Carter - Communications\n- Hana Sato - Legal Counsel\n- Doug Ellis - CFO\n- Priti Shah - Warehouse Operations Manager\n\nThings we want to test:\n- Do we know who can decide to take the scheduling server offline?\n- Do our backups actually restore? Last restore test was 14 months ago.\n- Who talks to customers about late shipments?\n- Who decides on the ransom question? (Policy says we don't pay, but has the CFO seen it?)\n- When do we call our cyber insurance company? The policy says within 72 hours.\n\nLogistics: Doug can only stay for the first 30 minutes. Room 4B, coffee provided. Session is 60 minutes total.","rules":[{"type":"numberedItems","count":5},{"type":"plainText"},{"type":"maxWords","max":160}],"mistakes":[{"title":"A full exercise plan","why":"The AI writes objectives, logistics, a debrief section and more injects than you can run in an hour.","fix":"Limit it: \"Exactly 5 numbered injects, nothing else.\"","checks":["numberedItems","maxWords"]},{"title":"No timing","why":"The AI lists events with no clock, so the facilitator can't pace the hour.","fix":"Show it: \"Start each with T+N min, going up, all under 60.\"","checks":["r0"]},{"title":"Generic roles","why":"The AI addresses 'the team' or invents a CISO you don't have.","fix":"Say: \"Address each inject to one role from the roster and end with a question.\"","checks":["r1"]},{"title":"Ignoring who leaves early","why":"The AI saves the ransom question for the end, after the CFO has gone.","fix":"Add: \"The CFO leaves at T+30, so his inject comes before that.\"","checks":["r2"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the printed facilitator sheet they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Gives the timing","patterns":["t\\+","60 min","minute"]},{"label":"Uses the roster","patterns":["roster","role","cfo","it lead"]},{"label":"Plans around the CFO","patterns":["30","leaves","doug","before"]},{"label":"Says exactly how many","patterns":["\\b5\\b.{0,25}(inject|line|item)","exactly (5|five)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"A tabletop runs on a clock with real people. Give the AI the time limit, the roster, and when the CFO has to leave.","rubricLabels":["Each of the 5 injects has a time like 'T+N min', the times go up, and every time is under 60 minutes","Each inject is addressed to one role from the roster (IT Lead, Communications, Legal Counsel, CFO, or Warehouse Operations Manager) and ends with a question for that person","Any inject addressed to the CFO is timed before T+30, and the injects cover the backup restore and the ransom decision"]}