After Action launches AI-powered tabletop exercises — Try an interactive demo →
Tactical Intelligence

TABLETOP_SCENARIOS

Deploy precision-engineered incident response simulations. Train your team against high-fidelity threat vectors in a controlled environment.

Active Operations148.02
QUERY SCENARIO DATABASE...
Complexity

Ransomware Attack

Simulated deployment of LockBit 3.0 variant across hybrid infrastructure. Focuses on containment protocols and backup validation.

180 MINNIST SP 800-61
Key Objectives
  • 01Execute immediate segmentation protocols
  • 02Coordinate with legal and forensic partners
Complexity

Supply Chain Compromise

A core CI/CD pipeline dependency has been poisoned. Navigate the complex web of vendor relations and integrity verification in this advanced scenario.

240 MINSLSA v1.0
Key Objectives
  • 01Audit third-party manifest dependencies
  • 02Implement zero-trust build architecture
  • 03Manage multi-party PR communication
Complexity

Insider Threat

A high-level engineer is exfiltrating intellectual property. Test your internal monitoring and HR-interlocking response procedures.

120 MINISO 27001
Key Objectives
  • 01Identify exfiltration pathways
Complexity

Cloud Drift Leak

S3 bucket misconfiguration leading to public exposure of customer data. Drill on identification, rapid closure, and reporting.

150 MINSOC2 Type II
Key Objectives
  • 01Detect misconfiguration via CSPM alerts
  • 02Execute containment and customer notification
Complexity

Spear-Phishing Ingress

State-sponsored actors leverage a zero-day in MS Outlook. Manage the initial breach and the subsequent lateral movement attempts.

300 MINMITRE ATT&CK
Key Objectives
  • 01Contain initial compromise vector
  • 02Map lateral movement and C2 channels
Complexity

OT / ICS Disruption

Exercise response to attacks on SCADA systems, safety system compromise, and IT/OT crossover in critical infrastructure environments.

240 MINIEC 62443
Key Objectives
  • 01Isolate IT/OT boundary
  • 02Activate safety system failsafes
  • 03Coordinate with sector ISAC
Complexity

Social Engineering Campaign

Test your team against vishing, deepfake impersonation, and pretexting campaigns targeting help desks and executives.

150 MINNIST SP 800-61
Key Objectives
  • 01Identify social engineering indicators
  • 02Activate help desk verification procedures
Complexity

Data Breach Response

Navigate breach notification timelines, forensic containment, regulatory obligations, and public communications after a confirmed data breach.

180 MINGDPR / CCPA
Key Objectives
  • 01Execute 72-hour notification timeline
  • 02Coordinate legal, PR, and forensic workstreams
25+
Scenarios
8
Threat Categories
100+
Decision Points
Full
ATT&CK Mapping

Want a custom scenario for your team?

We build bespoke exercises tailored to your industry, tech stack, and threat model — with full facilitation and reporting.