The Pencil-Drawn Outage Theater: Acting Out Incidents as Low-Tech Tabletop Dramas

When people talk about incident response, they usually imagine dashboards, war rooms, and pages of runbooks. But some of the most powerful preparation for real-world outages and attacks can happen with nothing more than a whiteboard, sticky notes, and a pen.

Welcome to pencil-drawn outage theater: low-tech tabletop dramas where teams act out incidents instead of just talking through them.

Done well, these simulations feel less like a meeting and more like an improvised play. People take roles, scenarios evolve in rounds, and unexpected twists test how the organization reacts under pressure. This theatrical style of tabletop exercise is especially valuable in a world where:

• Attackers weaponize AI to move faster, quieter, and at scale, and
• Your own AI systems become both tools and targets in high-stakes incidents.

This post walks through why outage theater works, how to design it for an AI-driven threat landscape, and practical steps to run your own low-tech tabletop dramas.

Why Act It Out Instead of Just Talk It Through?

Role-play may sound frivolous, but it solves a serious problem:

In the middle of a real incident is a terrible time to discover that your “plan” depends on tools you don’t actually have, approvals you can’t get in time, or people who don’t agree on priorities.

Acting out incidents helps you surface issues early:

• Hidden conflicts – Does security want to lock everything down while clinical or frontline teams must keep services running at all costs? Outage theater exposes these trade-offs in a safe space.
• Misunderstandings – Does “degrade non-essential services” mean the same thing to IT, operations, and cultural support teams? Often, it doesn’t. The drama forces clarification.
• Unseen constraints – Are there unspoken rules, cultural expectations, or resource limits that shape how people actually behave, not how the policy says they should?

By playing through realistic dramas, teams explore ways to meet different stakeholders’ needs without building resentment. People experience how decisions land on others — something that rarely happens in slide decks.

Designing Scenarios for an AI-Driven World

Modern tabletop theater can’t just be about “the database is down.” It needs to reflect how technology and threats have evolved, especially with AI.

1. Include AI-Enabled Attackers

Attackers increasingly use AI to:

• Automate phishing at massive scale and personalize messages
• Explore networks faster and identify weak points
• Generate highly realistic fake content (emails, voice, video)

Your tabletop scenarios should explicitly incorporate these capabilities. For example:

• A phishing wave generated by an AI model targets both executives and frontline staff in their preferred languages and cultural contexts.
• An AI-assisted intrusion test reveals how quickly an adversary can pivot through your environment once they’re in.
• Social engineering calls are reinforced with AI-generated voice clones of known leaders.

In the drama, play the attacker as a character:

• The facilitator introduces “AI-driven attacker actions” as scripted or improvised moves.
• These moves come with speed and scale advantages that stress-test your detection, communication, and decision-making.

2. Your Own AI Systems as Targets

It’s not just that attackers use AI; it’s that your AI becomes an attractive target:

• A clinical decision-support model is subtly manipulated to recommend harmful treatments
• A customer-service chatbot is redirected to leak sensitive information
• A fraud-detection model is poisoned so it “learns” to ignore a specific pattern of fraudulent behavior

Your tabletop theater should ask:

• Who owns this AI system in a crisis? Security, data science, product, compliance?
• Who has authority to shut it down, roll it back, or switch to manual procedures?
• How do you communicate with users or patients if the AI they rely on is suddenly untrustworthy?

Put these questions into the script. Force decisions.

The Anatomy of a Low-Tech Tabletop Drama

You don’t need a fancy cyber range to do this. You need:

• A room (physical or virtual)
• A simple map of systems, teams, and critical services
• Roles (CISO, on-call engineer, clinician, frontline supervisor, comms, cultural support, etc.)
• A scenario, with injects that escalate over time

Start Simple, Then Escalate

Real outages rarely explode all at once. They start small and grow. Your scenario should do the same.

Round 1: Baseline incident

• A minor anomaly is detected in logs
• A clinical team reports intermittent delays in a decision-support system

Round 2: Evidence of attack

• Security observes suspicious access patterns that look automated
• Helpdesk reports a spike in odd behavior from AI-powered tools

Round 3: AI-enabled escalation

• Attackers use AI to rapidly probe and exploit multiple systems
• AI-generated phishing messages start hitting both staff and partners

Round 4: Systems at risk

• Your flagship AI model shows signs of data poisoning
• External stakeholders report strange outcomes they suspect are AI-related

With each round, inject new information and force trade-offs:

• Do you disconnect critical systems and risk service impact?
• Do you trust model outputs while investigations are ongoing?
• How do you explain partial, uncertain information to leadership, regulators, or the public?

Use Sudden Injects to Mimic Real-World Chaos

To make the drama realistic and test adaptability, include surprise twists:

• Communication breakdown – Chat platform fails, conference bridge drops, or pager alerts are delayed.
• Key person unavailable – The one engineer who knows the legacy system is offline or unreachable.
• Unexpected dependency failure – A third-party service suddenly goes down, compounding the incident.
• Conflicting instructions – Leadership pushes for public reassurance while security wants to hold off on statements.

These injects don’t just make the game more exciting; they reveal how resilient your coordination structures really are.

Casting the Play: Roles and Perspectives

Effective outage theater is cross-functional by design. Aim to include:

• Operations / IT – Understand realistic recovery paths, workarounds, and technical constraints
• Security – Shape detection, containment, and communication about risk
• Frontline / Clinical or Service Staff – Describe real-world impact on patients, customers, or users
• Cultural Support or DEI Roles – Advise on how responses affect different communities, languages, and trust levels
• Communications / PR – Prepare internal and external messaging under uncertainty
• Legal / Compliance – Clarify regulatory deadlines and reporting obligations

Within the exercise, encourage people to stay in character, but not to the point of conflict. The goal is to:

• Explore how decisions feel from different vantage points
• Practice making and revising decisions as a group
• Learn how to disagree productively when time is short

After the Curtain Falls: Post-Incident Review

The drama doesn’t end when the scenario ends. The real value comes from the post-incident review.

This review should:

1. Include all relevant staff

   • Not just managers or security; ensure operations, frontline/clinical, and cultural support roles all speak.
   • Ask what felt realistic, what felt impossible, and what surprised them.

2. Capture both technical and human insights

   • Where were the technical gaps? Monitoring? Access controls? AI model governance?
   • Where were the human gaps? Authority, trust, communication, psychological safety?

3. Turn observations into concrete changes

   • Update runbooks, escalation paths, and contact lists
   • Refine AI governance policies and model rollback plans
   • Adjust training and onboarding materials

4. Feed lessons back into future dramas

   • Let the next exercise build on new capabilities and remaining weaknesses
   • Slowly increase complexity over time, especially around AI attacks and AI system failures

The review is where outage theater becomes an engine for continuous improvement rather than a one-off event.

Getting Started: A Simple Blueprint

If you’ve never done this before, start small and low-risk:

1. Pick one AI-relevant scenario

   • Example: “Suspected data poisoning of our recommendation model with growing customer complaints.”

2. Define three or four rounds with escalating injects

   • Begin with subtle anomalies, then add attacker behavior, then system failures.

3. Assign roles and timebox decisions

   • Give each round 10–15 minutes.
   • At the end of each round, ask: What do you do in the next 15 minutes? What do you communicate? To whom?

4. Introduce one surprise twist

   • A key communication tool fails
   • A regulator calls asking for an immediate briefing

5. Debrief thoroughly

   • Spend as much time debriefing as you did playing.

Repeat quarterly, increasing realism and complexity as your organization matures.

Conclusion: Rehearse the Crisis Before Opening Night

As AI reshapes both how we defend and how we are attacked, incident response can’t be purely theoretical. You need to rehearse — not just read — your plans.

Pencil-drawn outage theater offers a way to:

• Practice responding to AI-enabled attackers
• Protect and recover your own AI models under duress
• Surface conflicts, misunderstandings, and constraints before they cause real harm
• Explore solutions that respect diverse stakeholders, without the animosity that real crises can trigger

It’s inexpensive, low-tech, and surprisingly effective. Start with a whiteboard and a few willing volunteers, and let the drama unfold — now, while the stakes are still imaginary.