Case Study
What Happens When Tool Expertise Meets Domain Expertise?
Tool expertise vs. domain expertise. Explore the pre- and post-competition AutoTableTop™ studies to see what 36 exercises reveal about ransomware readiness, repeatability, and real-world water utility response.
What can we learn when the same AI-driven cybersecurity tabletop scenario is first exercised repeatedly by people familiar with the platform, then put in front of real-world water and wastewater professionals? ThreatGEN set out to explore that question using AutoTableTop™ version 2.0 and a ransomware crisis management scenario built around a water treatment facility's SCADA/HMI environment.
The result is a two-part case study examining performance before and after a live water and wastewater industry competition.
Establishing the Baseline: Pre-Competition Study
Before the competition, ThreatGEN support staff conducted 20 exercises using the same Water/Wastewater Utility scenario configuration. These exercises established a baseline that could later be compared with the performance of the competition participants.
The scenario challenged participants with issues extending well beyond the initial discovery of ransomware, including maintaining plant operations, mobilizing cybersecurity resources, regulatory compliance, public communications, multi-agency coordination, recovery, and incident command.
Putting the Scenario to the Test: Post-Competition Study
The next step was the real-world test.
At a water and wastewater industry conference in April 2026, 16 teams of working water and wastewater plant operators, maintenance technicians, laboratory staff, and collection systems professionals responded to the simulated ransomware attack using AutoTableTop™ version 2.0.
That created a dataset of 36 exercises from the same scenario configuration, 20 pre-competition exercises and 16 live competition exercises. Despite starting with the same settings, no two exercises played out identically, and every exercise generated an After-Action Report. The comparison produced one particularly interesting finding:
Tool familiarity raises the floor, but domain expertise raises the ceiling.
The pre-competition group achieved a higher mean average score, 6.5 versus 6.1, while the competition's top-performing team achieved the highest individual result of either group, 8.0, despite having never used AutoTableTop™ 2.0 before.
More Than a Single Tabletop Exercise
Together, the two studies demonstrate the value of treating tabletop exercises as something more than isolated events.
Running the same scenario repeatedly makes it possible to examine how different teams approach the same underlying crisis, identify recurring weaknesses, compare performance, and measure improvement. In this study, AutoTableTop™ automatically generated an After-Action Report for each exercise, including crisis-response metrics, areas for improvement, operational learnings, safety recommendations, and per-turn scoring.
Create once. Store it. Exercise repeatedly. Let the platform analyze. The tabletop exercise from a one-time event into a repeatable and measurable preparedness program.
Explore the Complete Water/Wastewater Scenario
The scenario page brings the two studies together with the scenario background, exercise themes, supporting materials, and post-competition presentation.