A tabletop exercise executives will actually remember

Most tabletop exercises are a slide deck read aloud. People nod, agree the plan is fine, and leave. Then the real incident arrives and the plan isn't fine.

Make them decide

The exercise should force choices with consequences. Not "what would you do," but "it's 6 p.m., the system is encrypted, the ransom note says 48 hours, and the journalist is calling. You have three options and ten minutes." Then take the option they chose and show them what happened next.

Build it around what actually hurts

Generic scenarios produce generic answers. The scenario should be the one that keeps the CFO awake: the specific system, the specific supplier, the specific regulatory clock. If people say "that would never happen here," you've found either a blind spot or a strong control. Either is worth knowing.

Inject the things nobody plans for

The backup admin is on leave. Counsel's number is wrong. The incident channel is on the system that's down. The board chair wants a statement before anyone knows what happened. Each injection is small, realistic, and reveals a gap the written plan hides.

End with decisions, not a debrief

A list of what went well is nice. A list of three things that will change by a named date is the point. Who owns each, and when will you run the exercise again to see if they're fixed.

The sign it worked

Someone leaves the room and changes something that afternoon. That's the only metric I trust.

I design and run these for leadership teams and for the people who'll actually be on the phones. If your last one was forgettable, the next one needn't be.

Explore: More on education and training · Work with me