How to Write Incident Tabletop Injects from a Threat Model
Tabletops fail when they mint a CVE id and a customer count. CVE was NONE. This is play, not a live incident, and not security advice.
The matching generator is the Incident Tabletop Inject Writer from a Threat Model (No Invented CVEs) (Incident Tabletop Inject Writer From A Threat Model No Invented Cves) prompt. Browse related cards in the PromptDig library (Browse more prompts). When a filled run survives, share the version you actually use (Share a prompt).
Banner tabletop only, not advice
Write tabletop injects from a pasted threat model. No invented CVEs, customer counts, or real PII. Start by filling Inputs, not by asking the model to remember last week's run. If a field is blank, write NONE or NOT IN INPUTS and leave it blank through Generate. The card is built so the model cannot honestly invent a number, owner, URL, or command that you did not paste.
Paste these fields before you hit run:
Exercise name and duration: [Exercise]
Pasted threat-model excerpt (assets, actors, controls): [Model]
Players and roles I may name: [Players]
Inject times I allow (elapsed minutes): [Times]
Facts I may use (tool names, log lines I made up for play): [Facts]
CVE or vuln I may cite (or NONE): [CVE]
What must never appear: [Never]
Words I must not use: [Banned]
How many injects: [Count or 5]
Advice banner: [Banner]
That inventory is the honesty ledger. Anything that does not appear there is forbidden in the draft. If you catch yourself adding a nice-to-have after the run, you are no longer using the card. You are ghostwriting. Put the extra fact in Inputs and run again.
Injects timed from the list you allowed
Generate is numbered on purpose. Do not skip a step because the first paragraph looked done. The early steps exist to stop later prose from smuggling claims.
Walk the Generate list in order:
- Banner: tabletop only, not a live incident, not security advice. Quote Banner.
- Honesty ledger: assets, actors, controls from Model, players, times, CVE. Forbidden: CVE ids not in CVE, customer counts, real PII.
- Inject list: Count rows. Time from Times. Stimulus from Model plus Facts. Player who receives it from Players.
- CVE line: only CVE. If NONE, describe the weakness in words without minting a CVE id.
- Facilitator notes: expected control from Model. Do not add a control the model omitted.
- Debrief questions: 3, answerable from Model. No asking for a real CVE.
- Never: production comms, real customer lists, live credentials.
- Compliance pass: quote Banned words, invented CVEs, invented customer counts. Cut them.
If a step asks for a version lock, quote the version from Inputs in the output. If a step asks for a refuse list, keep the refuse list in the published artifact, not in a sidebar you delete. Reviewers should see what the model was not allowed to do.
No minted CVE id when CVE is NONE
Most failures are the same shape: a missing field gets a confident fill. A conversion rate appears. A Gradle task appears. A flash point appears. A caption appears on a job that asked for slide text only. Your review is to search the draft for numbers, names, and commands, then grep Inputs. No match means cut.
Honor the constraints as hard stops, not vibes:
- Tabletop injects from a threat model. Not a live incident, not SDS, not a status page, not advice.
- Never invent a CVE id, customer count, or real PII.
- If CVE is NONE, do not mint an id.
- Keep injects inside Model assets and actors.
- No emojis.
When the card says not legal advice, not certification, not an exam dump, or not a caption engine, that sentence belongs at the top of the output. Deleting it to look more finished is how you inherit risk.
Stay inside the model assets and actors
Finish with the compliance pass the prompt already asks for. Quote the banned-word hits. Cut them. Print character counts when the job has a cap. Print word counts when the job has a budget. List gaps as gaps. Five missing facts are more useful than one smooth paragraph.
Tags on the card (incident tabletop injects, threat model tabletop, no invented cves) are a reminder of the job shape, not an invitation to wander into a neighboring cluster. If you need a different surface, open a different PromptDig card rather than stretching this one.
Fill the card, then run
Replace every bracket. Run on ChatGPT, Claude, or Gemini. Read the ledger first, then the artifact. If the model invents a commit, KPI, DOI, PEL, bid, or logo, discard the run. Tighten Inputs. Run again. Share the filled card that survived, not the first draft that sounded done.