Hands-on Threat Actor and Ransomware Emulation Exercises

Our founder, Abhijith B R, ran a hands-on activity at RSAC 2025 that put participants through realistic threat actor and ransomware scenarios. Each scenario was built to stress-test the kind of defenses organizations actually run in production, so attendees worked against the same controls, alerts, and decisions they would face during a real incident rather than a simplified classroom setup. The exercises walked through the stages of an attack, from initial access to the point where a ransomware operator would try to encrypt systems and demand payment, and asked participants to respond at each step.

Working through the scenarios, attendees saw first-hand how their controls hold up under pressure and where the gaps tend to open up. Some found that detections they assumed were solid never fired, while others learned that the slow part of a response is rarely the technology and more often the handoffs between people. The goal was to give each participant a practical read on how ready they really are for a live incident, along with a concrete list of the tooling, coverage, and process changes worth making before an actual attacker forces the issue.

The activity ran at Adversary Village at RSA Conference 2025, the community Abhijith founded, which hosted its adversary and ransomware emulation booth alongside a full program of hands-on activities. More about the event is on the RSA Conference 2025 site.

Abhijith B R is a recurring RSAC speaker; see his RSAC speaker profile.