Cybersecurity Roleplaying Workshop: Design & Implement Engaging Incident Response Exercises
A workshop on running tabletop exercises your security team actually wants to show up for.
The problem with most tabletop exercises
Most incident response exercises are a compliance checkbox, and everybody in the room knows it. People protect their turf, argue with the scenario, and check out somewhere around slide twelve of a scripted walkthrough. Nobody learns much, and nobody is better prepared for the real thing.
What I do instead
This four-hour workshop teaches you Malware & Monsters, the roleplaying framework I built for incident response training. Characters, dice, and a story that reacts to what the players do. You leave able to run exercises your technical people actually engage with, and that build real incident response skills while they are at it.
What You’ll Learn
Framework Fundamentals
- Core game mechanics that keep it realistic while adding some unpredictability
- Character development systems that reflect actual organizational roles and technical specializations
- Incident Master facilitation techniques for managing dynamic scenarios and participant interactions
- Three-round structure design that mirrors real incident progression from detection through resolution
-
Practical Scenario Development
- MITRE ATT&CK integration for technically accurate attack modeling
- Inject creation that introduces realistic complications and decision pressure
- Character conflict design that surfaces organizational tensions and communication challenges
- Balance: keeping it educational without killing the fun
-
Implementation Strategy
- Organizational adaptation methods for different team sizes and technical skill levels
- Resource planning including preparation time, materials, and facilitation requirements
- Getting a yes from management for training that looks like a game
-
Workshop Structure
Short instruction, lots of doing.
Live demonstration: volunteers experience the framework firsthand
Guided development: you build a complete exercise for your organization
Collaborative refinement: cross-team feedback and iteration
Implementation planning: concrete next steps and resources
What You Bring, What You Leave With
What you bring
Laptop with internet access and basic Git familiarity
GitHub account for the open-source scenario repository
Understanding of your incident response structure and typical threats
Authority or influence to change how your team trains
Basic markdown. No roleplaying experience needed
What you leave with
Complete scenario framework, ready to run
Character sheets and facilitation guides for your structure
Template library for developing further scenarios
Implementation roadmap with timeline, resources and stakeholders
Community access for ongoing scenario sharing and support
Why it works
There is solid research behind game-based learning for adults, technical fields included, and my own sessions say the same. Roleplaying exercises:
- Get people to participate because people remember what they felt
- Reveal communication gaps that a scripted tabletop never gets to
- Build empathy by making people play a role that is not their own
- Improve retention of procedures, because you used them instead of reading them
Surface realistic conflicts around priorities, resources, and authority
Practical details
You walk out able to run this yourself the following week. Tools, templates, and a community to lean on when you get stuck.
| Duration | 4 hours |
|---|---|
| Format | Interactive workshop with extensive hands-on development. I prefer running it in person, but virtual can be arranged. |
| Group size | 8 to 20 participants, so small-group collaboration works |
| Price | From 3.500 € |
| Deliverables | Complete scenario package plus implementation planning materials |
Get in touch and we will talk about dates, and about the threats your team should be training against.
