Skip to main content

Research Repository

Advanced Search

Scenario-based incident response training: lessons learnt from conducting an experiential learning virtual incident response tabletop exercise

Angafor, Giddeon Njamngang; Yevseyeva, Iryna; Maglaras, Leandros


Giddeon Njamngang Angafor

Iryna Yevseyeva


This paper aims to discuss the experiences designing and conducting an experiential learning virtual incident response tabletop exercise (VIRTTX) to review a business's security posture as it adapts to remote working because of the Coronavirus 2019 (COVID-19). The pandemic forced businesses to move operations from offices to remote working. Given that this happened quickly for many, some firms had little time to factor in appropriate cyber-hygiene and incident prevention measures, thereby exposing themselves to vulnerabilities such as phishing and other scams.

The exercise was designed and facilitated through Microsoft Teams. The approach used included a literature review and an experiential learning method that used scenario-based, active pedagogical strategies such as case studies, simulations, role-playing and discussion-focused techniques to develop and evaluate processes and procedures used in preventing, detecting, mitigating, responding and recovering from cyber incidents.

The exercise highlighted the value of using scenario-based exercises in cyber security training. It elaborated that scenario-based incident response (IR) exercises are beneficial because well-crafted and well-executed exercises raise cyber security awareness among managers and IT professionals. Such activities with integrated operational and decision-making components enable businesses to evaluate IR and disaster recovery (DR) procedures, including communication flows, to improve decision-making at strategic levels and enhance the technical skills of cyber security personnel.

Practical implications
It maintained that the primary implication for practice is that they enhance security awareness through practical experiential, hands-on exercises such as this VIRTTX. These exercises bring together staff from across a business to evaluate existing IR/DR processes to determine if they are fit for purpose, establish existing gaps and identify strategies to prevent future threats, including during challenging circumstances such as the COVID-19 outbreak. Furthermore, the use of TTXs or TTEs for scenario-based incident response exercises was extremely useful for cyber security practice because well-crafted and well-executed exercises have been found to serve as valuable and effective tools for raising cyber security awareness among senior leadership, managers and IT professionals (Ulmanová, 2020).

This paper underlines the importance of practical, scenario-based cyber-IR training and reports on the experience of conducting a virtual IR/DR tabletop exercise within a large organisation.

Journal Article Type Article
Acceptance Date Jan 18, 2023
Online Publication Date Mar 2, 2023
Publication Date 2023-10
Deposit Date Feb 1, 2023
Publicly Available Date Mar 2, 2023
Print ISSN 2056-4961
Publisher Emerald
Peer Reviewed Peer Reviewed
Volume 31
Issue 4
Pages 404-426
Keywords Incident response, Virtual incident response tabletop exercise, Disaster recovery, Cyber security, Scenario-based learning, Experiential learning
Public URL


Scenario-based incident response training: lessons learnt from conducting an experiential learning virtual incident response tabletop exercise (accepted version) (700 Kb)

You might also like

Downloadable Citations