Attack Simulation and Learning from Velocis helps organizations test whether incident-response plans, people, communications, and decision-making processes will actually work under pressure. Through facilitated cybersecurity tabletop exercises, teams can experience the complexity of a realistic cyber incident without disrupting production systems or creating real-world consequences.
Velocis develops scenarios based on threats such as ransomware, phishing, insider activity, business email compromise, data theft, cloud compromise, and advanced persistent threats. Exercises bring together the people who would need to make decisions during a real incident, including leadership, IT, security, legal, communications, operations, and other business stakeholders.
The goal of Attack Simulation and Learning is not to prove that the organization has a perfect response plan. It is to identify where plans, responsibilities, communications, escalation paths, and decision-making break down before a real incident exposes those weaknesses.
Attack Simulation and Learning Tests the Plan Before the Crisis
Many organizations have an incident-response plan. Fewer know how well that plan works when information is incomplete, executives need answers, systems are unavailable, legal questions emerge, customers are affected, and technical teams are still determining what happened.
A tabletop exercise creates a controlled environment where those challenges can be explored safely. Participants work through a developing scenario, receive new information as the exercise progresses, discuss decisions, and identify what they would do next.
CISA provides Cybersecurity Tabletop Exercise Packages specifically to help organizations discuss pre-incident information sharing, incident response, and post-incident recovery across realistic threat scenarios.
See CISA Tabletop Exercise Packages.
What Velocis Attack Simulation and Learning Includes
- Custom Cyber Incident Scenarios
Build realistic scenarios around the organization’s threat profile, technology, industry, operations, and business priorities. - Facilitated Tabletop Exercises
Guide participants through a structured cyber incident using progressive scenario injects, questions, and decision points. - Cross-Functional Participation
Engage security, IT, executives, legal, communications, operations, HR, risk, and other stakeholders who may be involved in a real incident. - Decision & Escalation Testing
Evaluate who makes critical decisions, what information they need, how incidents are escalated, and whether authority is clear. - Communications & Coordination Review
Test internal coordination, executive updates, legal involvement, customer communication, vendor contact, and external-notification processes. - After-Action Findings & Improvement Plan
Document lessons, response gaps, ownership issues, process weaknesses, and prioritized actions for improving preparedness.
Cybersecurity Tabletop Exercises Built Around Realistic Pressure
A useful tabletop exercise should feel credible enough that participants need to make real decisions. Velocis can design exercises around scenarios such as:
- Ransomware affecting critical systems
- Phishing leading to credential compromise
- Business email compromise and fraudulent payment activity
- Insider threat or unauthorized data access
- Cloud or SaaS compromise
- Third-party or supply-chain incident
- Data exfiltration and possible breach notification
- Executive impersonation or social engineering
- Advanced persistent threat activity
- Operational disruption involving critical business services
The exercise can be adjusted to the organization’s maturity. A team testing its first formal incident-response plan needs a different level of complexity than an experienced security organization testing executive decision-making during a multi-stage crisis.
Attack Simulation and Learning Is Cross-Functional
Cyber incidents rarely remain an IT-only problem. A ransomware event may involve business continuity, legal privilege, insurance, law enforcement, customer obligations, executive decisions, communications, financial impact, and recovery priorities.
Velocis Attack Simulation and Learning exercises are designed to bring those stakeholders into the same scenario so organizations can evaluate how well teams coordinate under pressure.
Typical participants may include:
- Executive leadership
- Security and SOC teams
- IT and infrastructure
- Legal and privacy
- Corporate communications
- Business continuity and operations
- Human resources
- Risk and compliance
- Vendor-management teams
- Cyber insurance or external response partners
Test Roles, Responsibilities, and Decision Authority
Incident plans often describe responsibilities at a high level but leave unanswered questions about who has authority to make high-impact decisions.
A tabletop exercise can reveal uncertainty around issues such as:
- Who can authorize system isolation?
- Who decides whether business operations should be shut down?
- Who contacts outside counsel or cyber insurance?
- Who communicates with executives or the board?
- Who determines whether customers or regulators may need notification?
- Who approves restoration of affected systems?
- Who coordinates with law enforcement or external incident responders?
Attack Simulation and Learning gives teams an opportunity to resolve those questions before a real incident forces decisions under time pressure.
Evaluate Incident Communications
Technical response is only one part of cyber-crisis management. Teams also need reliable communication paths while information changes rapidly.
Velocis exercises can test how incidents are reported internally, how executives receive updates, how legal questions are escalated, whether communications teams have enough verified information, and whether stakeholders know which channels should be used if normal systems are unavailable.
CISA’s exercise materials specifically include scenario and module questions addressing information sharing, incident response, and recovery, reinforcing the value of testing coordination rather than focusing only on technical containment.
Test the Incident Response Plan Against Reality
An incident-response plan can look complete on paper while still containing practical gaps. Contact information may be outdated. Responsibilities may overlap. Required vendors may not be included. Decision authority may be unclear. Backup communication methods may not exist. Recovery priorities may not be agreed upon.
Velocis Attack Simulation and Learning uses the exercise to compare documented procedures with how participants would actually respond.
That can expose gaps in:
- Incident classification and escalation
- Evidence preservation
- Containment authority
- Executive communications
- Legal and regulatory coordination
- Cyber insurance procedures
- Vendor and third-party contact
- Business continuity and recovery
- Post-incident review
Ransomware Tabletop Exercises
Ransomware is a strong tabletop scenario because it forces organizations to make technical, business, legal, communications, and recovery decisions at the same time.
An exercise may progress from an initial suspicious alert to widespread encryption, unavailable business services, possible data exfiltration, attacker communications, executive pressure, media questions, and recovery decisions.
Participants can evaluate whether they understand backup status, containment options, business priorities, insurance procedures, legal involvement, restoration dependencies, and internal communications.
If deeper technical response capability is required, Velocis can connect preparedness work with Digital Forensics and Incident Response.
Phishing and Business Email Compromise Scenarios
Phishing and business email compromise can test the connection between identity, employee behavior, finance processes, security monitoring, and executive response.
A scenario may involve a compromised account, malicious mailbox rules, fraudulent payment instructions, credential theft, internal impersonation, or additional lateral movement. The exercise can evaluate how quickly the organization recognizes the event and whether finance, security, identity, legal, and leadership teams coordinate effectively.
Lessons may connect to Velocis Human Risk Intelligence or Identity and Access Management when the exercise reveals gaps in user behavior or identity controls.
Tabletop Exercises for Leadership
Executives do not need to perform forensic analysis during an incident, but they do need to make decisions with incomplete information. Leadership exercises can focus on operational impact, risk acceptance, business continuity, communication, legal exposure, customer obligations, and resource decisions.
Velocis can tailor Attack Simulation and Learning for executive audiences so the exercise tests strategic decision-making rather than overwhelming participants with technical detail.
From Exercise to After-Action Improvement
The value of a tabletop exercise comes from what the organization changes afterward. Velocis documents observations and translates exercise findings into an improvement plan.
After-action findings may include:
- Unclear roles or decision authority
- Missing or outdated contact information
- Weak escalation procedures
- Gaps in incident classification
- Communication bottlenecks
- Insufficient evidence-preservation procedures
- Unclear business recovery priorities
- Vendor or third-party coordination gaps
- Missing security controls exposed by the scenario
Those findings can then be prioritized by urgency, ownership, and potential impact.
Attack Simulation and Learning Supports Continuous Readiness
One exercise provides a point-in-time view of preparedness. Organizations change: personnel move, applications are replaced, vendors change, new regulations appear, and threat scenarios evolve.
Repeating tabletop exercises over time allows teams to test improvements, introduce new scenarios, involve different stakeholders, and keep response responsibilities familiar.
CISA maintains a broad portfolio of tabletop exercise packages covering cyber scenarios such as ransomware, phishing, and insider threats, reflecting the value of recurring practice across different threat types.
See CISA Cybersecurity Scenarios.
Connect Tabletop Findings to the Broader Security Program
Exercises often reveal issues outside the response plan itself. A ransomware scenario may expose weak vulnerability management. A phishing scenario may reveal identity or human-risk gaps. A cloud incident may identify missing logging or excessive permissions. A third-party scenario may expose unclear vendor obligations.
Velocis can connect those findings with a Security Risk Assessment, Cyber Defense, Cloud Security, or other relevant capability so preparedness exercises lead to measurable security improvement.
Why Organizations Use Cybersecurity Tabletop Exercises
- Validate the incident-response plan. Determine whether documented procedures work in a realistic scenario.
- Clarify decision authority. Identify who can make critical business and technical decisions during a crisis.
- Improve cross-functional coordination. Bring security, IT, leadership, legal, communications, and operations into the same response process.
- Identify hidden gaps. Find missing contacts, unclear procedures, weak escalation paths, and overlooked dependencies.
- Build confidence through practice. Give participants experience responding to pressure before a real incident occurs.
- Create an improvement roadmap. Turn exercise lessons into prioritized actions that strengthen resilience.
Attack Simulation and Learning: Know How the Plan Performs Under Pressure
The purpose of Attack Simulation and Learning is not to create a theatrical cyber drill. It is to give organizations a controlled way to evaluate how people, plans, and decisions perform when a cyber event becomes a business crisis.
Velocis combines realistic scenarios, structured facilitation, cross-functional participation, progressive decision points, and after-action analysis to help teams identify weaknesses, improve coordination, and strengthen incident readiness before the next real event.