Most ransomware response plans are written once and never rehearsed. In my RSAC 2026 Learning Lab at Moscone Center, I have turned one into a game.
Participants followed an attack as it unfolded and had to make the real calls against the clock: when to contain, who to tell, when to escalate and how to recover. In the second half I showed how to design and run these exercises, so people could take the format back and use it with both their technical teams and their leadership.
