Scenario-based exercises (e.g., Cybersecurity Tabletop Exercise) have long been recognised in the field of cybersecurity as a highly effective tool to prepare for real-life incidents. Beyond simple scenarios, the training method can also provide a suitable framework for conducting complex exercises. A series of events based on a real but simulated information security incident can be used as an organisational scenario-based exercise to enhance the training method strategically. The advantage of this method is that it allows the scenarios to be effectively tailored to the organisation or department, using complex scenarios that require participants to manage events, draw conclusions and interact with other actors, often in a position with which they were previously unfamiliar. A major benefit of scenario-based exercises is that they allow professionals to experience the roles and responsibilities of others. This helps to develop strategic thinking, decision-making and communication skills, as well as an understanding of the threats posed by cyberspace. The study of this methodology focuses on the experience of scenario-based exercises already conducted from an information security awareness perspective, and on the potential, benefits and limitations of their application.