Designing a Security Scenario Worth Practicing

A scenario is a question, carefully worded.

Every good tabletop scenario is, at heart, a question aimed at your specific team. “What would you do if this happened, here, with the people you have on shift, using the tools you actually have?” The craft of scenario design is in wording that question well enough that the answers are worth gathering.

A poorly designed scenario produces a meandering discussion that does not challenge the team. A well-designed scenario produces specific decisions, uncovers specific gaps, and leaves the team better prepared for the situations that actually threaten them.

The five features of a scenario worth practicing.

1. Plausible

The scenario should be something that could plausibly happen at your facility. Not the most dramatic event imaginable. Not a movie plot. A plausible scenario for your specific organization, your specific community, your specific neighborhood.

For a church in Cape Coral, plausible might include:

• A disruption during Sunday service by a confused or agitated visitor
• A medical emergency in the children’s wing
• A threatening email received by the senior pastor
• A domestic dispute spilling into the parking lot
• A severe thunderstorm forcing an unexpected shelter-in-place during an event

Any of these are realistic for that specific setting. Each would produce useful practice.

2. Specific

Generic scenarios produce generic responses. Specific scenarios produce specific practice. Compare:

• “An active threat enters the building during service.” (Generic. What active threat? Which entry? Which service? Which day of the week?)
• “During the 10:30 AM Sunday service, an usher notices a man in the lobby who is pacing, talking to himself, and has what appears to be a firearm partially visible under his jacket. You are the usher.” (Specific.)

The second produces a real decision with real inputs. The first produces a discussion that could apply to any facility.

3. Time-compressed

Tabletops cover a simulated time window of minutes, hours, or even days in the span of the exercise itself. The compression is the craft. The facilitator must pace the scenario so that enough happens to test decisions, without rushing past the moments where practice is most valuable.

4. Decision-rich

A good scenario includes multiple decision points. Not just one opening decision, but a sequence. What do you do at minute one? What about minute five? What changes at minute ten when the first responder arrives? Each decision point is an opportunity to practice the reasoning that goes into real response.

5. Recoverable

The scenario ends somewhere. Either the situation is resolved, handed off to professionals, or fades into a longer-term recovery phase. A scenario that ends with the facilitator saying “and it just keeps getting worse, forever” does not produce useful learning. A scenario that ends with “EMS arrives, the response is handed off, now you are in the reunification phase” does.

The injects that test adaptation.

An “inject” is an additional development introduced partway through the scenario. The attacker has moved to the children’s wing. A second medical emergency has occurred elsewhere in the building. The phone lines have failed. Law enforcement is delayed. A news crew has arrived at the front door.

Injects test the team’s ability to adapt. They are particularly valuable because real emergencies rarely follow scripts. Something always changes. The team that has rehearsed adaptation, not just the initial response, performs better.

Good injects:

• Are plausible given the scenario so far
• Test a specific capability or decision that the initial scenario did not
• Arrive at a moment when the team is still processing the previous development
• Require the team to re-prioritize, not just add a task
• Are prepared in advance, not invented on the fly

Injects that are arbitrary, dramatic for drama’s sake, or designed to stump the team do not produce learning. They produce frustration.

The facility-specific elements.

A scenario for a church in Punta Gorda is different from a scenario for a daycare in Naples. The design has to know the facility.

Elements to incorporate:

• Actual layout. Real rooms, real hallways, real exits. Not generic spaces.
• Actual staffing. The people who would actually be on shift at the time the scenario occurs.
• Actual technology. The specific cameras, alarms, phones, and communication tools the organization has.
• Actual relationships. The specific law enforcement agency, EMS service, and community resources involved.
• Actual decisions. The decisions this specific leadership team would be making, given their authority structure.

Scenarios that incorporate these specifics test the response that will actually be needed. Scenarios that abstract them produce abstract practice.

Rotating through a scenario portfolio.

Organizations running quarterly tabletops need four distinct scenarios per year, and probably more. A sustainable approach is to build a portfolio of scenarios relevant to the organization and rotate through them.

A representative portfolio for a mid-size church in Southwest Florida:

• Active threat in the sanctuary during service
• Medical emergency in the children's wing
• Severe weather forcing shelter-in-place during a weekday event
• Disruption by an agitated visitor in the lobby
• Fire alarm requiring full evacuation during a busy Wednesday
• Lost child at the end of a large event
• Theft or break-in discovered by morning staff
• Threatening communication received by the pastor
• Cash-handling anomaly discovered during reconciliation
• Major vendor failure during preparation for a large event

Rotating through 8 to 12 scenarios across a year, with occasional repeats to test improvement, produces robust practice without novelty for its own sake.

The Hurricane Ian scenarios.

Several Southwest Florida organizations have, since 2022, incorporated Hurricane Ian-specific scenarios into their rotation. The scenarios do not replay the actual storm. They model plausible variants: different timing, different severity, different population profiles at the facility when the storm arrives.

The value is twofold. First, the organization continues to internalize the operational lessons of the real event. Second, the team rehearses for variants that could arrive in future seasons. A team that has tabletop-rehearsed hurricane response three years in a row responds to the next real event from a position of familiarity, not first-time improvisation.

The verse celebrates preparation in the seasons when it is easy, so that it is ready in the seasons when it is hard. Scenario design is that preparation, applied to the specific work of organizational response. The team that rehearses in quiet months will find itself ready in loud ones.

The facilitator’s preparation.

Designing a scenario and facilitating one are related but distinct skills. The facilitator needs to:

• Know the scenario deeply enough to improvise if the team takes an unexpected direction
• Pace the delivery so each phase gets adequate discussion time
• Deliver injects at appropriate moments
• Ask probing questions without leading participants to “correct” answers
• Manage conflict or tension that arises from difficult discussions
• Close the exercise with a productive debrief

For organizations without in-house facilitation experience, external facilitation for the first several tabletops is usually worth the investment. Over time, the team that has been through several externally-facilitated exercises can take over the facilitation role for simpler scenarios.

Starting with one scenario.

For organizations that have not yet designed a tabletop scenario, a simple path:

• Pick one realistic scenario for your facility. Write it in one paragraph.
• Identify the specific decisions the team would need to make during that scenario
• Sketch out the sequence of events, with rough timing
• Prepare two or three injects for moments when you want to test adaptation
• Draft debrief questions that target the key learnings you hope to surface
• Run the scenario. Revise based on what you learn.

The first scenario will not be perfect. The second will be better. By the fifth, the organization will have developed a consistent design pattern.

The case for external design.

For organizations that have the budget, external scenario design is often worth it, especially for:

• First-time tabletops where the organization has no internal experience
• Novel scenarios requiring input from someone who has facilitated similar exercises at peer organizations
• Complex multi-department scenarios that require expert integration
• Post-incident tabletops where emotional calibration is especially important
• High-visibility board or leadership exercises where the quality of the experience matters

For ongoing operational exercises, internal design is often sufficient after the organization has built some experience.

Scenarios are investments.

Every well-designed scenario is an asset that can be run multiple times, refined over years, and shared (appropriately) with peer organizations. Organizations that have built a portfolio of scenarios over several years have a significant asset compared to organizations starting from scratch each time.

If your organization in Fort Myers, Cape Coral, Naples, or Port Charlotte is ready to build a real tabletop practice, scenario design is one of the early disciplines to invest in. We would be glad to help design the scenarios that will serve your team for years to come.