October · Cybersecurity Awareness Month

Skip the tip sheet. Run the whole exercise.

Every October the industry hands out posters about strong passwords. They're fine, and CISA and the National Cybersecurity Alliance already give them away. So here's something harder to find: a complete facilitator-ready ransomware tabletop built for a hospital, that you can run yourself with your own leadership team.

Get the kit See what's in it

Three PDFs, 28 pages. Free, and nobody calls you afterwards. Run it, keep it, change whatever you want.

What is in the kit

Everything you need, and nothing to prepare.

Built for a facilitator who's never run one before. If you can read aloud and keep time, you can run this.

01The scenarioA ransomware incident at a fictional two-site health system, with a full situation background and starting conditions.

02Six injectsSequenced across detection, containment, external pressure and recovery, with timing for a 90-minute session.

03Narration scriptWritten to be read aloud. Every inject has its own passage, so you're never improvising in front of the room.

04HICS role cardsOne page per command position, with what that role owns and the questions they should be asking.

05Maturity ratingFour levels per inject, from Ad hoc to Established, so you rate what you saw and can measure the movement next time.

06ArtifactsA ransom note, a failed backup report, a downtime packet audit. Printable, and they change the room when you hand them out.

07Hotwash scriptFour questions in order, with a note on who answers first, so the debrief produces findings instead of congratulation.

08Findings templateA one-page after action format you can take to leadership without rewriting anything.

The gaps are planted on purpose. Downtime packets that don't match the plan. A clinical policy variance nobody is clearly authorized to grant. A notification clock that started before Command knew the data was exposed. Most hospitals have at least one of these, and the exercise is built so it surfaces on its own instead of being pointed out. Design note

Get the kit

Get it right now.

Say where to send it and the files appear on this page straight away. A copy goes to your inbox too, with links good for a week, but you don't have to wait for it.

After the kit

The kit is the paper version. Crucible is the live one.

Running it on paper works, and plenty of organizations stop there. Crucible runs the same kind of exercise with everyone on their own device, decisions logged in role and timestamped, and an after action record built from what actually happened instead of somebody's notes.

Join early access