AI-Augmented IR Tabletop Exercise Kit
Run your first IR tabletop without hiring a red team.
Four scripted tabletop scenarios built on 2026 threat intelligence (ransomware on virtualized infrastructure, AiTM credential phishing, insider threat with Azure AD backdoor, supply chain / MSP compromise), plus a self-contained facilitator guide, blank participant workbooks, an auditor-ready debrief template, and a severity classification matrix. Everything is mapped to SOC 2 CC7.x and NIST CSF 2.0 RS.* controls so the artifacts double as compliance evidence.
## key-features
- ✓4 scripted scenario scripts with inject timelines and facilitator prompts
- ✓Self-contained facilitator guide written for IT managers with no red team experience
- ✓Blank participant workbooks with a 12-row decision log
- ✓Debrief template with a compliance attestation section
- ✓Severity Classification Matrix (P1-P4 with example triggers)
- ✓SOC 2 CC7.x and NIST CSF 2.0 RS.* compliance mapping throughout
- ▸Facilitator Guide (PDF + MD) — 5 chapters plus planning calendar template
- ▸Scenario 1: Ransomware on Virtualized Infrastructure (PDF + MD)
- ▸Scenario 2: SaaS Credential Phishing / AiTM Attack (PDF + MD)
- ▸Scenario 3: Insider Threat — Data Exfiltration (PDF + MD)
- ▸Scenario 4: Supply Chain / MSP Compromise (PDF + MD)
- ▸Participant Workbook (PDF + MD) — print one per participant
- ▸Debrief and Lessons Learned Template (PDF + MD)
- ▸Severity Classification Matrix (PDF + MD)
- ▸Complete bundle delivered as a single zip
## goes-well-with
From the same shelf
ASTGL PowerCLI Automation Cookbook v1.0
14 production-ready PowerShell 7 scripts for vSphere admins — built for Broadcom VCF.PowerCLI, ships-to-vCenter ready.
MCP Server Setup Guide for Sysadmins
A hands-on guide for sysadmins and IT pros to deploy, configure, and secure local MCP servers — covering tool selection, auth patterns, network exposure controls, and integration with Claude Code and local LLMs.
IT Offboarding & Knowledge Transfer Kit
Structured templates for capturing and handing off institutional IT knowledge when someone leaves — access deprovisioning checklist, system ownership matrix, undocumented-workaround interview guide, and a 30-day successor onboarding plan.
## not-ready-to-buy
Take the field notes instead
One practical write-up a week from the same workbench these kits come from — plus reader pricing when new kits ship.