How to write tabletop exercise injects and a master scenario events list

L7-1What makes a good inject?

A good inject gives a player something they would really receive and cannot ignore: an alert, a call from the help desk, an email from a supplier, a journalist's question, a ransom note. It should force one decision the objectives care about. An inject that only adds colour, or that tells players what to do, wastes time.

• Realistic channel: it arrives the way it would in real life, by email, phone, chat, ticket or news.
• Named recipient: it goes to one role, so someone owns the response.
• One decision: it asks for a choice, not general discussion.
• Linked objective: it maps to an objective the evaluator is grading.

L7-2What goes in the MSEL?

The master scenario events list is the timed script that drives the exercise. A spreadsheet is enough. Use one row per inject and these columns.

• Number and planned time (for example T+10 minutes).
• Channel and sender (for example a phone call from the help desk).
• Recipient role.
• Inject text, exactly as the player receives it.
• Expected action or decision.
• Objective it tests.
• Notes for the controller: what to do if the expected action does not happen.

For example, from the voice-phishing scenario in our 2026 scenarios article: T+0, phone call to the help desk from a caller claiming to be a travelling executive who asks for a multi-factor reset; expected action, the help desk follows its verification procedure; objective, the reset procedure is followed and escalated.

L7-3How should the injects be paced?

Three phases work for most tabletops. Detection and triage: the first signs arrive and players decide whether this is an incident and how severe. Escalation: the scope grows and the business, legal and communications decisions arrive. Recovery and disclosure: players decide what to restore first, what to tell whom, and what they still do not know. Leave space between injects for discussion; a new inject every few minutes stops people thinking.

L7-4What are contingency injects?

Reserve injects the controller uses only if needed. If the room stalls, a contingency inject adds information that moves the discussion on. If players race ahead, one adds a complication, such as the backup being unavailable or a key person being unreachable. Mark them clearly in the MSEL so they are not released by mistake.

L7-5When does a platform write the injects?

Writing an MSEL by hand takes time, which is one reason many teams exercise only once a year. Platforms change the work. TryHackMe generates a tabletop from industry, attack vector and tech stack and lets teams edit injects or re-prompt. Immersive Labs describes dynamic injects and AI actors. Hack The Box Crisis Control mixes scenario waves, injects, emails, news and social updates. Conducttr simulates news, social media and messaging around players, under facilitator control. Reflex Security runs an unscripted AI adversary and simulated stakeholders instead of a fixed list. Even with a platform, check that each inject still ties to an objective you will grade.