Fortinet | Behind the Tabletop: What a Hospital Ransomware Exercise Can Teach Us About SOC Readiness

Value of the Information & Strength of the Argument

The value of this webinar lies in its practical, experience-based insights grounded in a real exercise with 150 participants. The presenter effectively argues that having the right security tools is insufficient; organizations must also test whether people, processes, and communication can work together under pressure. The argumentation is well-structured, using a narrative scenario that progressively shows how technical incidents escalate into crises involving legal, communications, and executive functions. The use of live audience polls throughout the webinar strengthens the argument by directly demonstrating how perspectives vary even among cybersecurity professionals. The presenter concludes with actionable takeaways, such as establishing clear escalation procedures and governance structures, that viewers can implement in their own incident response plans.

Scientific Rigor, Source Quality, Title Accuracy

The webinar demonstrates solid scientific rigor by basing its conclusions on a structured workshop with simulated real-world conditions. The methodology of using personal role cards and timed injects is well-documented and lends credibility to the findings about decision-making under uncertainty. However, no external academic sources or industry frameworks are explicitly cited, which limits the depth of scientific grounding. The title is precisely accurate, capturing the webinar’s essence of examining a hospital ransomware exercise to derive lessons for SOC readiness. The production quality is professional, with clear progression and interactive elements that add authenticity without compromising the educational value.

The title accurately reflects the content: the presenter takes viewers behind the scenes of a hospital ransomware tabletop exercise and analyzes what it reveals about SOC readiness.

8/10

The webinar is presented by a Fortinet technical trainer with direct experience running the tabletop exercise at a WiCyS conference. The content is based on real workshop observations with 150 participants, providing authentic insights into incident response decision-making. No external academic sources are cited, but the methodology is grounded in standard incident response practices and the presenter's professional experience.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 02:00WiCyS organization overview and agenda introduction by Morgan Garland
• 05:00Paula Buki sets the scene with a storytelling approach: ransomware hits a hospital at 7am
• 10:00Explains why tabletop exercises matter—gaps are communication and responsibility issues, not just technical
• 15:00Describes the workshop setup: 150 participants, stakeholder cards, decision cards, and scenario timeline
• 25:00Audience polls reveal initial assumptions: most think phishing email is the entry point
• 30:00Key decision: whether to isolate affected systems immediately, creating tension between security and patient care
• 40:00Discusses the dilemma of partial suspension of imaging services with controlled exceptions
• 50:00Authority and governance questions: who decides on negotiations, public communication, and regulatory notifications

• Fortinet Training Institute — Mentioned as a resource for free Fortinet courses and certifications
• WiCyS (Women in CyberSecurity) — Organization website mentioned for membership, programs, and events

• MITRE ATT&CK framework — Supports the discussion of attack vectors and lateral movement patterns relevant to ransomware scenarios