Table Top Exercises for Cybersecurity
Most tabletop exercises I've sat in on as an outside observer are theater. Everyone already knows the plan, the scenario is soft enough that nothing surprising happens, and the debrief is a round of congratulations. That's not a tabletop exercise, that's a rehearsal of a script. The point of running one is to find out what breaks when the room doesn't have a clean answer.
A tabletop exercise is a facilitated, scenario-based walkthrough of an incident, run with the actual people who'd be in the room if it happened for real: IT, legal, communications, a business owner, sometimes an executive. No systems get touched. The value is entirely in the decisions people have to make out loud, under time pressure, with incomplete information, and in watching where the plan on paper and the plan in people's heads diverge.
What I actually do
I build the scenario around your environment, not a generic ransomware template. If you're a healthcare practice, the scenario involves patient data and breach notification timelines. If you're a manufacturer, it involves a vendor-introduced compromise on the plant floor. I inject complications as the exercise runs, the kind that never show up in a tidy incident response plan: the on-call engineer is traveling, the insurance carrier wants to be looped in before counsel is ready, a reporter calls during hour two. I'm watching for where decision rights are unclear, where the escalation path has a single point of failure, and where "someone will handle that" turns out to mean no one will.
Afterward you get a real debrief, not a participation certificate. I write up what the exercise actually revealed: the gaps between the documented plan and what people did in the room, the decisions that took too long because no one had the authority to make them, and a short, prioritized list of what to fix before the next drill. I'd rather hand you three concrete fixes than twenty vague recommendations you'll never action.
Who this is for
If you have an incident response plan that's never been tested against people who'd actually be in the room, or it's been more than a year since the last drill, that's the signal. It's also worth doing after a reorg, after you've onboarded a new MSSP or insurance carrier, or before an audit that's going to ask whether your plan has been exercised.
If you want a tabletop that tells you something you didn't already know, get in touch and let's talk about your environment and who needs to be in the room.