Cyber Crime Tabletop Exercise for Insurance Companies

This exercise is part of our catalog of tabletop exercises for insurance companies.

Scenario Overview

Participants are the leadership and management team of a fictional insurance organization when, without warning, the internal network slows to a crawl, outgoing email refuses to send, and employee workstations begin to reboot unexpectedly. Normal operations are disrupted immediately, affecting claims processing, communications, and customer service.

As the situation unfolds, leadership must evaluate the operational impact, coordinate internal communications, and determine how to maintain critical business functions while the disruption continues. This scenario focuses on management response rather than technical troubleshooting. While IT can work in parallel to discuss technical actions, the primary emphasis is on how leadership handles the business, communications, and recovery challenges created by the incident.

This exercise challenges insurance leaders to make decisions under pressure during a fast-moving cyber event that affects systems, policyholder data, customer confidence, and day-to-day operations.

Why This Scenario Matters for Insurance Companies

Insurance companies depend on technology, communications, and uninterrupted access to policyholder and claims data to operate effectively. A cyber incident can quickly disrupt claims processing, customer service, and internal operations while also creating regulatory and reputational risks.

This exercise helps leadership teams evaluate how they would respond when a cyber-related disruption begins affecting systems and communications before the full scope of the incident is understood, especially in an environment where customer expectations and regulatory requirements remain high.

Exercise Objectives

• Evaluate leadership decision-making during a fast-moving cyber disruption.
• Discuss coordination between management, operations, communications, and IT.
• Review how the organization would communicate with policyholders, regulators, employees, and vendors.
• Assess priorities for maintaining claims processing and customer service during a system disruption.
• Identify escalation thresholds and management actions during a developing cyber event.
• Strengthen business resumption planning for technology-driven disruptions.

Typical Participants

• Executive leadership
• Operations and claims leadership
• Information technology leadership
• Information security or cyber response personnel
• Communications or public affairs staff
• Compliance or regulatory personnel
• Business continuity or crisis management team members

Exercise Format

Conduct-It-Yourself Tabletop Exercises are structured, discussion-based simulations designed to help organizations test their response to disruptive events without the time and cost of a fully facilitated exercise. Participants are placed in the middle of a realistic scenario as it unfolds and must work through decisions, priorities, and consequences as a leadership team.

Each downloadable exercise package includes everything needed to conduct the session internally, including facilitator instructions, exercise overview materials, participant forms, a detailed scenario script, and a ready-to-run PowerPoint presentation that guides the scenario and discussion. The materials are designed so organizations can conduct the exercise as delivered or customize the storyline and supporting materials to reflect their own operations, business lines, and testing objectives.

Most exercises are designed to be conducted in approximately 2 to 4 hours. A typical agenda includes an exercise overview and scenario briefing, the facilitated disaster simulation discussion, group review and preparation for debriefing, and a structured post-exercise discussion to capture lessons learned and improvement opportunities.

Exercise Focus

• Crisis Management
• Communications
• Business Resumption

Related Tabletop Exercise Scenarios

Organizations exploring this scenario may also find these exercises useful:

• Pandemic Tabletop Exercise for Insurance Companies
• Train Wreck Tabletop Exercise for Insurance Companies
• Gas Main Explosion Tabletop Exercise for Insurance Companies
• Shelter-in-Place Tabletop Exercise for Insurance Companies
• Workplace Hostage Tabletop Exercise for Insurance Companies
• Hurricane Tabletop Exercise for Insurance Companies
• Tornado Tabletop Exercise for Insurance Companies

Purchase & Download

This exercise is delivered as a downloadable package that includes facilitator instructions, scenario materials, and structured discussion prompts to guide the exercise.