“Company Prepares” is a cyber preparedness exercise for everyone in the organization. It helps employees think about how a cyber incident could affect their own work and what they are responsible for.
By looking at real-life situations and talking about what to do, participants go from just being aware to actually being prepared. This builds confidence and organizational resilience.
The exercise also helps everyone to shared understanding of risk and the values that guide your organizations’ approach to security.
You can find the full “Company Prepares” scenario in your PrepJam Templates if you have a paid plan. This guide will walk you through each step of the exercise.
Starting the exercise
At the start, make it clear that all responses are anonymous. Let participants know that their answers cannot be traced back to them and will only be used to help everyone learn together. This makes it easier for people to share their questions, mistakes, concerns, and honest thoughts.
The first question should be simple and not require much thought. The goal is to help people learn how to submit their answers in the app, making it easy for everyone to join in. As the facilitator, you do not need to spend much time on these answers. Just say that this is a warm-up question, quickly share what you notice, and maybe ask if using the app was easy.
The second question asks participants to think about what could happen to the company. Give everyone enough time to answer, especially for questions where they write their own thoughts. This question helps set the stage and shows why the exercise matters. Afterward, briefly go over the answers and use them to highlight why it is important for the company to become better prepared.
The hackers' way in
The scenario starts with a text message telling participants to update their computers by clicking a link to a video. Ask someone to read the message out loud. To make the situation realistic, add context. For example, the message arrives while a participant is busy with something else and under pressure to submit a report the next day. The video says it will show how to update the system, but it actually installs malware. You do not need to show the video right now; we will come back to it at the end of the scenario.
After the update SMS, ask participants what they think a colleague would do. These kinds of messages often seem easy to spot after the fact, but in the moment, they can be very convincing. By talking about “a colleague,” it is easier to see that anyone could be tricked. Many people think they are less likely to fall for scams, just like most people think they are better drivers than average, but that is not always true.
You can also change how the hacker gets in, depending on what you want to focus on. For example, you could use fake password update requests, email attachments, fake job offers, or bad QR codes, instead of the ClickFix attack in this example.
Ransomware detected
Next, our unlucky “colleagues” notice the ransomware. Tell a short story about Anna and Richard (or use names from your own organization, but make sure to use the same names throughout and check with those people first) and how they find the ransomware on their computer.
When the ransomware screen shows up, explain what participants are seeing. Ransomware often spreads through bad email links or attachments, but attackers can also use weaknesses in software.
Once ransomware is installed, it can run quietly in the background and lock up files so you cannot open them. Normally, encryption is used to keep information safe, but ransomware uses it to block access. It is like locking your files in a box that only the attacker can open.
Explain that the ransom note is the message that pops up on the victim’s screen. It usually asks for payment, often in cryptocurrency, in return for a key to unlock the files.
If the ransom is not paid, the organization might lose access to its data for good. The attackers might also threaten to share private information.
Next, ask participants what they think the appropriate response would be. The free-text format will generate a range of responses that, taken together, are likely to identify the correct course of action.
Someone will probably suggest paying or not paying the ransom. You can save this discussion for later.
When you sum up, focus on the most important steps employees should take if they see ransomware. Use a few clear points that are easy to remember. For example:
Disconnect your computer from the internet by unplugging the network cable or turning off Wi-Fi. This will prevent the ransomware from spreading further.
If possible, take a photo of the ransom note.
The most important action is to report the incident promptly.
After discussing the participants’ responses, show a page that describes your organization’s reporting channels.
It is also interesting to check if participants know how to report an incident when they cannot use their computer.
The next page shows that another colleague, Anna, also has ransomware on her computer. This means there are now several cases of ransomware in the organization.
Next, ask participants what they would do after reporting the incident. Even though most employees who do not have a special response role, their actions still matter. For example, telling colleagues not to turn on their computers and to wait for instructions is more helpful than blaming others or spreading rumors.
Payment or not
The next pages talk about whether or not to pay the ransom. Some organizations avoid this topic because they do not want to suggest that paying is an option. Still, we recommend having this discussion so everyone knows what to do.
After participants submit their responses, the group must make a final decision. If they choose to pay, the exercise will branch to page 15; otherwise, it will proceed to page 16 of the exercise.
The general advice, however, is not to pay the ransom. There is no promise that you will get your data back, and paying only encourages more attacks.
Crisis response
Participants get a text message that looks like it is from the IT department. To get everyone involved, ask someone to read it out loud. Make sure to point out how serious the situation is.
Also, explain what these messages will look like and which phone number they will come from. Make it clear that these messages will never ask for passwords, verification codes, or personal information.
The IT team then takes things further and announces that the network and IT systems will be shut down.
The next page asks who has the authority to order a shutdown, noting the potential cost of suspending operations. Use this discussion to make it clear who makes this decision in your organization.
The next page gives an update: crisis teams are set up, and people gather in common areas to talk about what is happening. You should use the right terms for your company here. In general, a crisis management team is formed when something big happens, so resources can be used differently than usual. The crisis team makes sure all parts of the organization work together to handle the situation.
The next question asks participants how the IT shutdown affects their work. Answers will be different depending on each person’s job, whether they help customers directly or work in a support role. By sharing these views, everyone can better understand the impact, not just on their own work, but across the whole organization. This is a good way to connect cyber risk to business risk.
How could this happen
When something like this happens, it is normal to wonder what caused it. The points on the next page all show possible ways this scenario could happen, depending on what controls are in place.
The next page asks participants to think back to the SMS they got. What should they do in this situation? Most of the options are right, except for doing nothing. The main point is that any information you have could be important for the people handling the situation.
For the next page, remind everyone that mistakes are not made on purpose. In the moment, people are just trying to get their work done, so their actions seem reasonable. If something happens that could affect security, reporting it early helps the organization respond, reduce the impact, and learn from it.
Hackers are back
The attackers are now threatening to publish the organization’s stolen data unless the ransom is paid, a common ransomware tactic.
Participants receive an SMS linking to a video, which is also shown on the next page. The video shows the hackers threatening to publish the stolen data unless the ransom is paid. Begin by asking what they received, then play the video.
Next, ask participants what information they can access. Give them enough time to answer, then point out how much and how sensitive the exposed data could be. This helps everyone understand the possible consequences, just like in the earlier discussion about the IT shutdown.
The next page gives an update and asks participants how the organization can keep things running. Talk about this question together.
Media on the phone
Participants then get a phone call. Ask them to answer it and invite someone to share what the caller says. You can also play the call out loud for everyone.
On the next page, participants are asked how they would respond. Once they have answered, briefly summarize their suggestions.
Explain that ransomware incidents often draw media attention, especially if services are down or data might be exposed. While official information is still limited, journalists may contact employees directly by phone, email, or social media.
Add your company’s specific advice to the next page. In general, employees should politely say they cannot comment and direct the journalist to the designated spokesperson, communications or public relations team, or general manager if there is no one else.
Closing up
To finish the scenario, ask participants again if they would pay to stop the stolen data from being published. Use this discussion to remind everyone that the general advice is not to pay. There is no guarantee the attackers will keep their promise, and paying only supports more crime.
Next, spin the Wheel of Misfortune. The result will show if the attackers were telling the truth about stealing and publishing the data, and whether the organization ends up lucky or unlucky. This is a light way to end the exercise.
Now, show the video from the first SMS to explain how the attack started, using the method called ClickFix. Point out that reporting early could have stopped or limited the incident, and that employees are important in keeping the organization strong.
Adapt the final page to fit your organization. Summarize the key takeaways, explain where employees can find guidance, and clearly state how to get support or report any concerns.
Reinforce that everyone plays an important role in protecting the organization from cyberattacks.
You can find the full Company Prepares scenario in your PrepJam Templates if you have a paid plan.