The document you’ll have in your hands by the end of this article is a two-page script. Not a policy. Not a vendor risk assessment. A script — the kind with scene headings, a protagonist who wants something, and decision points where your staff actually have to choose. You’ll read it aloud around a table with your colleagues, and by the time you finish, you’ll know whether your incident-response checklist works when a human being is holding it under pressure.
Tabletop exercises are how large organizations rehearse incidents, and there’s nothing proprietary about the format. A small newsroom, a two-person nonprofit, a solo lawyer with an assistant can run one in 90 minutes with a printer, a whiteboard, and the checklist you already claim to follow. What most guides skip is the hard part: writing a scenario that’s plausible enough to matter. That’s a documentation skill, and it borrows directly from how fiction writers structure a plot.
Why a threat scenario is a story with the antagonist as protagonist
Reedsy’s writing guidance on plot construction states the irreducible minimum of any story: a protagonist who wants something and is prevented from getting it, with stakes that are concrete — what is lost if they fail, and for whom. That is also the irreducible minimum of a useful threat model. Your adversary is the protagonist. Their want is your source’s identity, your story before publication, or your device at a border. The obstruction is your security practice. The stakes are what gets exposed if the adversary succeeds.
If you write a scenario without a specific adversary want, you get a vague exercise: “there’s a breach, what do we do?” Nobody learns anything from that, because nobody has to make a real decision. If you write one without proportionate stakes, the exercise feels like a fire drill — going through motions. The scenario needs a named character, a specific lure, a clock, and a moment where the room disagrees about what to do. That disagreement is the entire product of the exercise.
Screenwriting structure maps onto this cleanly. StudioBinder’s screenwriting guide breaks classic story structure into exposition, rising action, midpoint, climax, falling action, and resolution — a roadmap that keeps a narrative focused rather than a sequence of disconnected events. Your scenario has the same beats: normal operations (exposition), the lure arrives (rising action), someone clicks or someone doesn’t (midpoint), the consequence surfaces (climax), the response runs (falling action), and the debrief (resolution). The guide’s point about scene headings and present-tense action lines applies too: a script formatted so a facilitator can read and execute it is worth more than a beautifully written memo nobody can run in real time.
Before you draft: pick the adversary you actually have
Don’t invent a nation-state because it’s dramatic. Pick the adversary your beat attracts. Three realistic archetypes for small newsrooms and nonprofits:
- The source-hunter. Someone who wants to identify a confidential source. Vector: a phishing email impersonating you, sent to the source — or impersonating the source, sent to you. This is the scenario I’d run first in any newsroom, because the failure mode is silent.
- The opportunist. Someone who wants money or account access, not your story. Vector: an invoice-themed phish to your bookkeeper, or a SIM-swap on a staff phone. Small organizations fail this one constantly, and it’s fully rehearseable.
- The authority figure. A border officer, a subpoena server, or a police demand for footage. Vector: a seized laptop at a re-entry queue, or a letter citing a statute you haven’t read. This scenario is mostly a legal-preparation exercise, and it’s the one where your checklist most likely has a blank page.
Write the scenario for the archetype you judge most likely in the next twelve months. If you can’t decide, that judgment itself is your first finding — record it in the debrief.
The scenario template (copy, paste, fill in)
Keep it to two pages. Courier 12-point is not required, but the discipline of screenplay format is: fixed sections, present tense, third person, no editorializing. Here is the template, with a filled-in example for the source-hunter archetype:
SCENARIO TITLE: The Second Email
ARCHETYPE: Source-hunter
DURATION: 90 minutes (60 play, 30 debrief)
PARTICIPANTS: Facilitator, editor, reporter, source-facing staff member
EXPOSITION (5 min, facilitator reads aloud):
It is a Tuesday. Reporter [NAME] has been working a story about
municipal contracting for six weeks. The source, "ALEX," has only
ever used Signal, from a phone Alex owns. Alex knows the story's
topic but not the publication date.
RISING ACTION (inject 1):
At 09:14, Alex forwards an email to [NAME]: "Did you send this?"
It's a message that appears to come from [NAME]'s work address,
subject line "quick question before we publish," with a link.
MIDPOINT (inject 2):
The link, if checked, resolves to a lookalike login page on a
domain registered 11 days ago. Alex has NOT clicked it yet —
but Alex replied to the email asking if it was really [NAME].
That reply went to the attacker's address.
CLIMAX (inject 3):
At 10:02, Alex reports that a second email arrived, this one
referencing the municipal contractor by name and the phrase
"we know you've been talking."
FALLING ACTION (the room works the checklist):
Participants use the organization's actual incident checklist.
RESOLUTION (debrief, 30 min):
Facilitator records: what the checklist answered, what it
didn't, who was unsure of their role, and what changes today.
Two rules while drafting. First, every inject must force a decision the checklist claims to cover — if your checklist says “contact the source through a verified channel,” the scenario should make someone actually do it, and discover whether a verified channel was ever established. Second, the adversary must behave plausibly: real phishers reuse publicly available details (the contractor’s name is on the council agenda), and real seizures happen at predictable moments (return travel, not departure). Plausibility is what makes the room take it seriously.
If you find yourself stuck at the drafting stage — and many people do, because scenario construction is genuinely hard — structured outlining tools can help. Reedsy’s plot generator works by taking a protagonist, a conflict, and stakes, then building a structured outline you refine act by act; the same approach works for adversary scenarios, and if you want a drafting environment built around that kind of structured narrative scaffolding, the Unsloppy AI Writing App’s plot generator tools are one place to develop the beats before you commit them to your exercise script. The tool produces the structure; the plausibility, the local details, and the decisions your staff must rehearse are yours to build — exactly as Reedsy notes, a generator won’t make your creative decisions for you.
The first 60 minutes: a decision tree to test
This is the tree your participants should walk during the falling-action phase. It’s deliberately short, because in a real incident the first hour is about triage, not forensics. Print it and mark it up during the exercise — every mark is a finding.
MINUTE 0-5: Confirm the facts you actually have.
Who saw what, on which device, at what time?
Do NOT act on the attacker's framing of events.
MINUTE 5-15: Classify.
Is a confidential source's identity in question? → source-safety
track: verify contact channel NOW, before anything else.
Is an account credential possibly entered? → containment track:
revoke sessions, rotate the password, check active logins.
Is a device physically gone or demanded? → legal track: invoke
your counsel's number, say nothing, and confirm the right
posture for your jurisdiction with counsel before the exercise.
MINUTE 15-30: Contain.
Source-safety: establish or re-verify a pre-agreed signal.
Containment: rotate every credential that shared the
compromised password. Check email forwarding rules.
Legal: document the demand in writing, timestamp it.
MINUTE 30-45: Notify.
Who must know within the organization, in what order?
Who decides whether the story's publication timing changes?
Who talks to the source, and through which channel?
MINUTE 45-60: Record.
Write down what happened while it's fresh. This log is the
document your debrief — and any later legal process — runs on.
Notice what the tree assumes: a pre-agreed contact signal with sources, a password manager that shows shared credentials, a counsel’s phone number in someone’s wallet. If any of those don’t exist, the exercise just found you three tasks. That’s the point.
Running the 90 minutes
Assign a facilitator who does not play a role — they read the injects, keep time, and take notes. Participants use only the documents they’d really have: the printed checklist, the decision tree, their own phones. No laptops for looking things up mid-scenario unless your real response would allow it. Read each inject aloud, give the room five to ten minutes to work it, and resist the urge to help. The facilitator’s job is to watch where people hesitate, argue, or reach for a document that doesn’t exist.
Spend the last 30 minutes on the debrief, and structure it: what did the checklist answer, what did it not answer, who was unsure of their role, and what one change will each participant complete this week. Write the answers down. An exercise without a written debrief is theater.
What this exercise does not do
Be honest about the limits, because overstating them is how organizations end up with false confidence:
- It does not test your technical defenses. Nobody’s mail filter, disk encryption, or MFA configuration is exercised by people talking in a room. A tabletop tests your procedures, not your controls.
- It does not prove your staff will behave the same way under a real incident. Rehearsal improves the odds and surfaces gaps; it does not guarantee performance.
- It does not cover every archetype. Running the source-hunter scenario tells you nothing about how you’d handle a subpoena or a ransomware note. Plan a second exercise for a different archetype within three months.
- It does not replace legal advice. If your scenario involves a seizure or a statutory demand, the debrief should end with a question for a lawyer, not an answer improvised by your editor.
What to do today
Block 90 minutes on the calendar for next week — that’s the only scheduling this requires. Pick your archetype, fill in the template with names and details from your actual beat, and print your current incident checklist. If you open the folder and find there is no current checklist, you’ve completed the exercise’s first finding before anyone sat down: draft a one-page checklist this week, even a bad one, and let the tabletop tell you what to fix.
The script you produce is a real artifact. Keep it, date it, and rerun a variant of it every six months. Security you can rehearse is security you can verify — and a room that has already argued about what to do at minute fifteen argues much better when minute fifteen arrives for real.