Ransomware Tabletop Drills
Small and mid-size firms are being told by cyber insurers and enterprise clients to prove they've tested their incident-response plan, but they're too small to afford the $15K-$40K tabletop packages built for Fortune 500 security teams. A facilitator who runs a tight half-day drill with a firm's actual staff and hands over a real after-action report can fill that gap at a price a 20-150 person company will actually pay.
A real, growing compliance-driven demand pocket (insurance renewals, SOC 2, vendor questionnaires) that's underserved between free CISA self-service and expensive enterprise consulting firms — but it's a facilitator-hours business, capped by one person's calendar until you train and license other facilitators.
The wedge is the after-action report, not the exercise itself: CISA gives away the scenario packages for free, so the paid product has to be the credible outside facilitator, the realistic pressure of role-played negotiation and legal/PR injects, and a signed document an insurance underwriter or enterprise client will actually accept. Firms with 20-150 employees are the sweet spot — big enough to be asked for proof of IR testing, too small to have a security team or budget for $15K+ vendor engagements. Renewal season (most cyber policies renew annually) creates a natural, recurring demand cycle rather than a one-time sale.
Spikes around Q1/Q4 insurance renewal cycles and Q4 budget-flush; slower in summer.
Suits you if
- ✓You have real incident-response, SOC, or MSSP experience and can role-play an active breach convincingly
- ✓You're comfortable facilitating a room of non-technical executives and staff for 3-4 hours
- ✓You can sell B2B via referral relationships with insurance brokers, MSPs, or compliance consultants
- ✓You want a service business with a clear per-engagement price, not a product to build
Skip it if
- ✕You need a scalable, low-touch business — this is priced and delivered one room at a time
- ✕You don't have IR/security credibility and can't get a name-brand cert (GCIH, CISSP) or track record quickly
- ✕You're not willing to do outbound sales to brokers and MSPs to build a referral pipeline
- ✕You want to compete on scenario content alone — CISA's free packages commoditize that layer
| Units | Revenue range | Note |
|---|---|---|
| 2 | $3,600–$5,000 | Part-time, early referral pipeline |
| 5 | $9,000–$12,500 | Full-time solo facilitator, steady referrals |
| 9 | $16,200–$22,500 | Near solo-facilitator ceiling; requires hiring to grow further |
Skills: Core requirement is IR/security operations credibility — either direct SOC/IR work history or a recognized certification (GCIH, CISSP, or similar) plus the ability to speak insurer and vendor-risk language (SOC 2, NIST CSF references). Secondary skills: scenario/curriculum design, live facilitation of mixed technical/non-technical rooms, and basic B2B sales to insurance brokers and MSPs who can become referral channels.
Unlock "Ransomware Tabletop Drills"
Get the full step-by-step plan, tools list, and experience breakdown with lifetime access to the whole database.
Get full access