Tabletop Exercises
Facilitated simulations where your team faces a realistic incident in a meeting room — and finds the gaps in the plan before an adversary does.
- Who it is for
- Crisis committees, executive teams, and technical teams that need to practice coordination under pressure, or to validate a newly developed response plan.
- Typical duration
- 3 to 4 hour session · 2 weeks preparation
- Frameworks
- NIST SP 800-84CISA Tabletop Exercise Packages
A tabletop exercise is the cheapest way to discover that your response plan does not work. It costs a morning. Discovering it during a real incident costs considerably more.
How it works
We gather your team in a room, with no computers and no system access. We present a scenario that begins with very little information — the way every real incident begins — and develop it through successive injects while the team decides what to do.
No technology is involved. What gets tested is coordination, decision authority, and communication, which is where most organizations actually fail.
Three levels
Executive. Board and senior management. The focus is business decisions: public communication, regulatory notification, the ransom question, operational continuity, relationships with key customers.
Technical. IT and security teams. The focus is containment, analysis, vendor coordination, and technical decisions made on incomplete information.
Combined. Both groups in the same room. The most revealing and also the most uncomfortable, because it makes the translation gap between technical and executive visible — and in a real incident, that gap costs the most time.
Scenarios we run
Always adapted to your context, the most requested are ransomware with prior exfiltration and double extortion, business email compromise with wire fraud, a vendor compromise with access to your network, a malicious insider with privileged access, and public disclosure of customer data.
What shows up nearly every time
After facilitating these exercises, the same findings recur with remarkable consistency: nobody is certain who has authority to take production offline; the contact tree is out of date and half the numbers no longer answer; everyone assumes the backup works but nobody has tested a full restore; and the technical and executive teams discover, live, that they held incompatible expectations about who decides what.
Better to discover all of that on a Tuesday morning, over coffee.
How we run it
- 01
Scenario design
We build a plausible incident using your real technology, your real vendors, and your real dependencies. A generic scenario does not generate useful discussion.
- 02
Inject preparation
Information is revealed in phases, as in a real incident — incomplete, contradictory at the start, and sometimes wrong.
- 03
Facilitation
We run the session, press on decisions, and keep the pace. The facilitator is not a passive observer.
- 04
Structured observation
We record what was decided, who decided it, how long it took, and what information was missing. That is where the real findings are.
- 05
Report and correction
We convert what we observed into concrete changes to the plan, not a list of good intentions.
What you receive
- Scenario built specifically around your organization, technology, and sector
- Session facilitation with progressive information injects
- After-action report with identified gaps and observed decisions
- Prioritized action plan with owners and deadlines
- Update to your response plan reflecting what was learned