These are AutoTableTop™ scenarios and their associated case studies, transcripts, incident respond plans, and network maps. These scenarios are meant to help tabletop exercise facilitators using the AutoTableTop™ simulation tool understand where to “get started” and best practices.
If you have a GREAT idea for a scenario, please share your ideas with the ThreatGEN Support Group.
Texas Water 2026 Scenario
| AutoTableTop, cybersecurity, HMI, ICS, OT, SCADA
ThreatGEN® partnered with the Water Environment Association of Texas (WEAT) to power the McKim and Creed Cybersecurity Exhibition Event at the 2026 Texas Water Operations Challenge in San Antonio on April 29, 2026. AutoTableTop™ version 2.0 served as the platform for a ransomware crisis management exercise in which 16 competition teams, composed of working water and wastewater plant operators, maintenance technicians, laboratory staff, and collection systems professionals — responded to a simulated ransomware attack on a water treatment facility’s SCADA/HMI systems.
The Stryker “Wiper” incident
| AutoTableTop, cybersecurity, scenario
The Stryker Corporation cyberattack of March 11, 2026 represents a structural shift in the cyber threat landscape. This was not a ransomware attack for financial gain — it was a state-aligned destructive wiper operation conducted by Handala, an Iran-linked hacktivist group assessed by multiple intelligence firms as a front for Void Manticore, a destructive operations unit within Iran’s Ministry of Intelligence and Security (MOIS). The stated motivation was retaliation for U.S. military strikes in Iran.
Rockwell Advisory PN1633 Tabletop Scenario for AutoTableTop™
| advisory, AutoTableTop, Rockwell, scenario
A critical vulnerability (CVE-2023-3595 and CVE-2023-3596 in Advisory ID PNI1633) has been discovered in Rockwell Automation’s FactoryTalk Linx product, which is widely used for industrial automation. The flaw allows for remote code execution and denial-of-service attacks, potentially giving attackers administrator-level access and control over industrial systems.
SolarWinds 2019 Scenario
| AutoTableTop, scenario, solarwinds
Sometime around January 2019, hackers from a group known as SolarStorm gained access to SolarWinds’ network using either a zero-day vulnerability in a third-party service or application, a brute-force attack or social engineering.
Municipal Water Authority of Aliquippa (MWAA) 2023 Scenario
| AutoTableTop, cyberattack, Municipal Water Authority of Aliquippa, utility, water utility
The Municipal Water Authority of Aliquippa (MWAA), a public utility that provides water service to residents and business in Aliquippa, PA experienced a cyberattack on November 25, 2023. This scenario recreates that attack.
Colonial Pipeline 2021 Scenario
| AutoTableTop, Colonial Pipeline, ransomware, scenario
Colonial Pipeline ransomware attack from May 2021, one of the biggest incidents in history with its impact on the U.S. Everything to help new facilitators learn how to use AutoTableTop.