Tabletop Exercise

A tabletop exercise is a discussion-based simulation in which the people who would handle a real incident walk through a realistic scenario together, step by step, and make the decisions they would have to make on the day — without touching live systems. It tests the incident response plan, the people, and the gaps between them, at a fraction of the cost of learning the same lessons during an actual breach.

How it works

A facilitator presents an evolving scenario in stages called injects: an employee reports a suspicious wire request; then the CFO's mailbox shows sign-ins from an unfamiliar location; then a journalist calls. At each stage, participants state what they would actually do — who they notify, what they contain, what they tell employees and customers — and the facilitator probes the answers against the written plan. Good exercises involve more than the security team: finance, legal, HR, and communications all own decisions in a real incident, and tabletop sessions routinely reveal that no one agrees on who authorizes disconnecting a system or paying a ransom demand.

Scenarios built around social engineering — business email compromise, deepfake voice calls, help desk impersonation — are particularly valuable, because they test judgment and verification procedures rather than purely technical playbooks.

How to run one well

• Pick one scenario and a 90-minute slot. A focused exercise that finishes beats an ambitious one that doesn't.
• Use injects with timestamps and incomplete information, because real incidents never arrive fully explained.
• Assign a scribe. The deliverable is a written list of gaps — unclear ownership, missing contacts, procedures that exist only in someone's head — with owners and deadlines.
• Repeat at least annually and after major changes. Insurers and frameworks increasingly ask for the date of your last tested exercise, not just the existence of a plan.
• Close the loop with training. Gaps involving employee behavior — slow reporting, skipped verification — feed directly into the next quarter's awareness and simulation program.