A day that shows how your team decides when things go wrong.
A cybersecurity tabletop exercise (TTX): a crisis simulation with no technical setup. A facilitator, a room, a scenario and injects released over time. The team argues, decides under pressure, finds out who actually knows what, and leaves with a written decision log.
We do not lecture you on incidents. We help you go through one.
In the room
- A fictional scenario, set in your sector.
- Injects released one after another that force decisions under pressure.
- A facilitator who keeps the pace and an observer who writes down every decision and who took it.
What you walk out holding
- The day's decision log.
- A four-page report: who decided what, what was missing, the next three fixes.
- When the exercise closes with "Copy and paste": a written rule for the AI tools your staff use.
The format
- Length
- Half a day.
- Participants
- 6 to 20 people in mixed roles: management, finance, HR, IT, front office.
- Injects
- Three to four, released one after another during the exercise.
- Who runs it
- A facilitator, plus an observer who keeps the decision log.
- What you receive
- A four-page after-action report: who decided what, what was missing, and the three fixes.
The five scenarios
All five are fictional composites built on incident patterns Albania has seen. We name no real organisation, in sales or in delivery.
1 · Insider data exposure
Payroll on WhatsApp
A spreadsheet with the names, ID numbers and salaries of your staff is circulating on WhatsApp. A journalist calls within the hour.
What it tests: Who is told first; whether this is a personal-data breach you must notify, and within what deadline; how you tell your own staff; how you look for the source without accusing the room.
Best for: HR, finance, management. Everyone in Albania recognises it at once.
2 · Business email compromise
The changed invoice
A long-standing supplier emails new bank details on the day a large invoice is due. The email thread looks correct. The payment is scheduled for 16:00.
What it tests: The call-back rule; who can authorise an exception; what happens when the director cannot be reached; whether anyone says "no" to urgency.
Best for: Finance, procurement, small and medium businesses.
3 · Ransomware against a deadline
The tax deadline
Your accounting server is encrypted four days before a filing deadline. Backups exist, but nobody has restored one in a year.
What it tests: The pay-or-not decision; the manual fallback; what you tell the tax authority and your clients; who owns the decision.
Best for: Accounting firms and any company with hard regulatory deadlines. It ties directly to the duty to file declarations on time under Law 9920 on tax procedures; the penalty for a late filing stays with the taxpayer.
4 · Impersonation and deepfake authorisation
The director's voice
A voice note, then a short video call, from the director, who is travelling, authorises an urgent payment and the release of a client file. The voice is right. The manner is right.
What it tests: Whether a verification culture exists at all; what the out-of-band channel is; whether a junior member of staff is empowered to refuse.
Best for: Everyone.
5 · Client data pasted into a public AI tool
Copy and paste
A capable employee pasted a client contract, with names and figures, into a free chatbot to summarise it. They did it to be fast. They did it three months ago.
What it tests: Whether you know which tools your staff use; what your acceptable-use rule is; whether this is a breach; what you tell the client.
Best for: Every office. It closes the exercise and opens the AI courses in the same breath: the fix is not a ban, it is a trained workflow.
Variant for institutions: a state portal your work depends on is down or compromised for three days. It tests continuity, the paper fallback and communication with citizens.
After the exercise
When the team also wants the fix, the exercise closes with "Copy and paste" and continues with the workshop that turns the rule into a workflow for the AI tools your staff already use.