Course Objective
What this programme helps you achieve
A hands-on 1 day programme that builds practical, job-ready capability in this area. Delivered through guided walkthroughs, worked examples and reusable checklists you can apply immediately.
UnderstandBuild a clear, structured understanding of the core concepts, terminology and drivers behind this domain.
ApplyTranslate the framework into practical actions, controls and working methods you can use on real engagements.
AssessEvaluate current-state maturity, identify gaps and prioritise the improvements that reduce the most risk.
DeliverProduce the artefacts, evidence and reporting expected of a competent practitioner in this area.
Market Need
Why this matters now
Ransomware Readiness and Tabletop Exercise addresses a capability that organisations increasingly need but often lack in a structured, defensible form. Teams frequently rely on ad-hoc knowledge, scattered documents or vendor claims instead of a repeatable method.
This programme closes that gap. It gives participants a shared vocabulary, a practical method and a set of reusable artefacts so the organisation can operate this domain consistently rather than reactively.
◆
Framework alignment: Scenario-based tabletop aligned with NIST and CISA ransomware guidance.
What makes this programme useful
01
Practical Focus
Every module is grounded in real scenarios, walkthroughs and reusable checklists rather than theory alone.
02
Career Relevant
Skills map directly to in-demand roles and to how organisations actually operate this domain.
03
Structured Path
A logical progression from fundamentals to applied practice, with a clear takeaway toolkit.
Key Learning Areas
What participants will learn
The modern ransomware kill chain and double extortion
Ransomware readiness assessment
Backup, recovery and immutability strategy
Detection and early-warning indicators
Containment and isolation decisions under pressure
Ransom decision, legal and communication factors
Facilitated tabletop exercise scenario
After-action review and improvement plan
1 Day Agenda
Structured learning flow
09:00–10:15
Module 1 — The modern ransomware kill chain and double extortion
Concepts, guided walkthrough and discussion covering the modern ransomware kill chain and double extortion.
10:30–11:45
Module 2 — Ransomware readiness assessment
Concepts, guided walkthrough and discussion covering ransomware readiness assessment.
12:00–13:00
Module 3 — Backup, recovery and immutability strategy
Concepts, guided walkthrough and discussion covering backup, recovery and immutability strategy.
14:00–15:15
Module 4 — Detection and early-warning indicators
Concepts, guided walkthrough and discussion covering detection and early-warning indicators.
15:30–16:30
Module 5 — Containment and isolation decisions under pressure
Concepts, guided walkthrough and discussion covering containment and isolation decisions under pressure.
16:30–17:00
Module 6 — Ransom decision, legal and communication factors
Concepts, guided walkthrough and discussion covering ransom decision, legal and communication factors.
09:00–10:00
Module 7 — Facilitated tabletop exercise scenario
Concepts, guided walkthrough and discussion covering facilitated tabletop exercise scenario.
10:15–11:30
Module 8 — After-action review and improvement plan
Concepts, guided walkthrough and discussion covering after-action review and improvement plan.
Audience & Entry Level
Who should attend?
This programme is designed for professionals who work with, or are moving into, this area of cybersecurity, governance or technology.
Incident ResponderSOC AnalystForensic InvestigatorMalware AnalystThreat Intel AnalystIT Security TeamCSIRT MemberSecurity Engineer
Recommended prerequisite
A general awareness of information security or IT concepts is helpful. No specific certification is required to attend.
Learning Outcome
What participants should be able to do after the course
- Confidently work with the modern ransomware kill chain and double extortion.
- Confidently work with ransomware readiness assessment.
- Confidently work with backup, recovery and immutability strategy.
- Confidently work with detection and early-warning indicators.
- Confidently work with containment and isolation decisions under pressure.