When ransomware affects a bank's payment systems, restoring the affected servers is only part of the challenge. Security teams still need to establish how far the attacker got, while payment operations must determine which transactions were processed, which remain pending and whether customers can safely continue using the service.
These decisions involve several teams, often working with incomplete information and under pressure to restore operations.
A ransomware tabletop exercise gives banks an opportunity to work through those situations before a real incident. By introducing realistic developments and examining how participants respond, security leaders can identify gaps in their procedures, decision-making and recovery arrangements.
Here's how to structure an exercise that produces useful findings.
Start With a Clear Exercise Objective
An effective tabletop needs a defined purpose. Trying to examine every aspect of ransomware response in one session can make it difficult to identify where the organisation needs to improve.
For this example, let's use a fictional bank whose business payment-processing service has been disrupted by ransomware.
The exercise will assess whether the bank can investigate the incident, coordinate containment decisions, manage disruption to payment processing and establish the conditions for restoring the service.
This gives the session a practical focus and allows participants to work through the consequences of their decisions.
Before the exercise, identify the systems and people supporting the payment service, including any external providers responsible for critical infrastructure. Review the bank's existing incident response procedures, recovery objectives and service dependencies.
Participants should use these materials during the session, just as they would during a real incident.
The exercise should also have clear boundaries.
For example, participants may discuss isolating systems and restoring backups, but those actions will remain simulated.
Any technical testing against actual infrastructure should be authorised and managed separately.
Get the Right People Involved
Ransomware response in banking requires coordination between security teams and the people responsible for keeping financial services running.
A SOC analyst may identify a compromised account and recommend disabling it. However, that account could also support a payment application, scheduled processing job or external integration.
The security recommendation needs to reach someone who understands the operational consequences and has the authority to approve the action.
For this exercise, involve the incident response lead, SOC representative, payment service owner, IT recovery lead and a representative from payment operations.
Legal, compliance, communications and third-party risk teams should participate where the scenario involves their responsibilities.
Assign a facilitator to introduce developments and guide the discussion. An observer should independently record the decisions, supporting evidence and any difficulties participants encounter.
Ask everyone to bring the procedures and contact information they would normally use.
The Scenario: Ransomware Disrupts Payment Processing
The fictional bank provides a payment initiation service to business customers.
On a weekday morning, endpoint monitoring identifies suspected ransomware activity on a server supporting payment processing. The SOC isolates the affected server and begins investigating whether an administrator account has been compromised.
Payment operations reports that customers can still submit instructions, but downstream processing has become unreliable. Some payments remain queued, and the bank cannot immediately confirm their status.
A processing cutoff is approaching. The infrastructure team believes a recent backup is available, although it has not established whether the affected service can be restored safely.
At this point, the facilitator gives participants the initial incident report, relevant system information and extracts from their response procedures.
The team should establish who is leading the incident, which systems require investigation and what immediate steps are necessary to protect the payment service.
As the exercise develops, additional information will challenge those initial decisions.
Build a ransomware scenario around your bank's critical services and response priorities.
A Practical 90-Minute Exercise Plan
A 90-minute session provides enough time to explore several developments while keeping the discussion focused.
The facilitator should allow participants to respond to each development before introducing the next.
If the team requests additional information, establish where it would come from and whether it would realistically be available.
Exercise Stage 1: Investigating Wider Compromise
The SOC discovers that the administrator account associated with the ransomware activity also accessed another server shortly before the initial system was isolated.
The second server supports a different application, and investigators haven't yet established whether it was compromised.
The security team must determine whether the evidence justifies expanding containment.
Ask participants how they would investigate the additional activity, which logs or endpoint records they would examine and how they would distinguish legitimate administration from malicious access.
If the recommendation is to disable the account, the payment service owner should explain whether any important processes depend on those credentials.
This discussion can reveal weaknesses in identity visibility, dependency mapping and the authority to perform containment actions.
The observer should document the team's decision, the evidence supporting it and any information that remains unavailable.
Exercise Stage 2: Managing Payment Disruption
Payment operations reports that transaction queues are growing and some business customers may miss time-sensitive payment obligations.
The infrastructure team recommends suspending new submissions while it investigates the processing failures. However, the bank's operations team is concerned about the consequences for customers.
Participants now need to determine how the payment service should operate during the incident.
Depending on the bank's architecture and contingency arrangements, options may include temporarily suspending the affected channel, activating an approved alternative process or continuing restricted operations.
Each option carries different operational risks.
The discussion should establish who can authorise the decision, how pending transactions will be accounted for and what information customers and relevant counterparties need.
The facilitator should also examine whether the bank's documented fallback procedures are practical.
For example, a contingency process may depend on staff who are unavailable or a system that shares infrastructure with the affected service.
These are weaknesses the bank needs to understand before relying on the process during a genuine disruption.
Exercise Stage 3: Assessing a Data Breach Claim
The bank receives a ransom demand claiming that customer information was stolen before the encryption began.
The attacker provides a small sample of what appears to be customer data.
Investigators have not confirmed whether the sample is genuine or whether information was transferred outside the bank.
The legal and security teams must establish how to assess the claim and determine what further investigation is required.
Relevant evidence may include network records, access logs and information about the affected systems.
The exercise should also examine how the incident commander communicates the situation to senior management. An attacker claiming to possess customer information is a serious development, but that claim alone does not establish the nature or extent of a breach.
Participants should distinguish confirmed findings from information still being investigated.
Legal, privacy and regulatory teams should apply the reporting obligations relevant to the institution and the incident's classification.
For EU financial institutions, this may include the applicable requirements under the Digital Operational Resilience Act (DORA).
Other regulatory and data protection obligations may also be relevant.
The exercise should establish who assesses those requirements, what information supports the assessment and how important decisions are documented.
Exercise Stage 4: Deciding When to Restore the Service
The infrastructure team confirms that a recent backup is available and believes the affected payment application can be restored.
However, payment operations has identified inconsistencies between transaction records.
Some instructions were accepted before the outage, but their processing status remains uncertain. The investigation into the second server is also incomplete.
The bank must now decide whether the available evidence supports restoration.
Security responders should explain whether the known attacker access has been contained and what monitoring will remain in place.
The recovery team should establish how the restored systems will be validated.
Payment operations must determine how pending and potentially affected transactions will be reconciled, including how duplicate or missing payments would be identified.
Build a ransomware scenario around your bank's critical services and response priorities.
How to Facilitate the Discussion Effectively
A facilitator's role is to keep the session focused on the decisions and responsibilities being tested.
When participants propose an action, ask how it would be carried out and what evidence would confirm the result.
For example, if the SOC recommends disabling a compromised account, establish who has the permissions to do so, whether approval is required and how the team would verify that access was revoked.
Where participants disagree about a system dependency, record the uncertainty and assign someone to confirm the actual configuration after the session.
Allow participants to refer to their existing procedures. The objective is to understand whether those procedures support an effective response.
It's also useful to observe how participants handle situations where the information is incomplete.
During a real incident, teams may need to make proportionate decisions before every detail is known. The exercise should show whether they can explain their reasoning, identify the remaining risks and decide when to review the situation.
Turn the Debrief Into Specific Improvements
The debrief should examine how participants handled the scenario and what the bank learned about its response capabilities.
Review the decisions made during each stage, including the information participants used and the difficulties they encountered.
Focus particularly on gaps that could delay or weaken a real response.
Assign an owner and completion expectation to each action.
Where possible, validate changes through another exercise or technical test. Updating a procedure may resolve a documentation gap, but a repeat activity can establish whether people can use the revised process successfully.
Keep the observer's notes, significant decisions and supporting exercise material together so reviewers can understand how the findings were reached.
Build a ransomware scenario around your bank's critical services and response priorities.
Use Technical Exercises to Validate What the Tabletop Reveals
A tabletop can establish whether participants understand the decisions involved in containing ransomware and recovering a payment service.
Some of those decisions also depend on technical capabilities that need separate testing.
For example, the exercise may reveal uncertainty about whether the SOC can identify lateral movement from a compromised administrator account.
That finding could inform a hands-on investigation exercise using realistic authentication, endpoint and network telemetry.
Similarly, uncertainty about backup integrity or transaction recovery may require a controlled restoration test involving the relevant infrastructure and operations teams.
Choose follow-up activities based on the weaknesses observed during the tabletop. This gives the bank a more focused way to improve readiness and examine whether corrective actions have worked.
Run Ransomware Tabletop Exercises With TryHackMe
For banks, the value of a ransomware tabletop comes from understanding how security and business teams would respond when an incident threatens an important financial service.
TryHackMe's AI Tabletop Exercises allow organisations to develop scenarios around their environment, incident response procedures and operational priorities.
Teams can work through evolving situations, examine their decisions and review the findings afterwards.
We spun up an exercise in minutes and it immediately drove productive debate. We updated our IR playbook during the session after identifying an escalation gap.
The scenarios kept analysts engaged, and the report turned decisions into clear next steps, so we've added TryHackMe's tabletop exercises to our quarterly training cadence.
Build a ransomware scenario around your bank's critical services and response priorities.
Ayomide Joseph A.
