Tabletop Exercises: Rehearsing the Crisis Before It Arrives

There is a reason emergency services drill relentlessly: under real stress, people do not rise to the occasion, they fall to their level of preparation. Security is no different, and the cheapest, most effective way to prepare for an incident without suffering one is the tabletop exercise — a structured, talk-through rehearsal of a realistic scenario. It requires no downtime, no special tools, and a couple of hours, yet it routinely surfaces gaps that would otherwise be discovered at the worst possible moment.

A tabletop is not a technical test; it is a decision-and-communication test, which is exactly where real incidents tend to go wrong.

How it works

Gather the people who would actually be involved in a real incident — not just security, but leadership, IT, legal, communications, whoever holds a relevant decision. A facilitator presents a scenario: "An employee reports their laptop is behaving strangely and files are being renamed." The group then talks through what they would do, step by step, and the facilitator injects developments: "Now the file server is affected. Now a customer tweets that their data is for sale. Now it's 2am and the on-call person isn't answering."

The value is in the discussion the scenario forces: who is called, who decides, what is checked, what is communicated. Nobody touches a keyboard; the exercise probes the plan and the people, not the systems.

What it reliably reveals

Tabletops surface the same categories of gap again and again. Unclear authority: nobody is sure who can approve taking a system offline. Missing contacts: the plan references a vendor whose number nobody has, or an employee who has left. Untested assumptions: "we'll restore from backup" meets "has anyone verified the backups actually work?" Communication confusion: who tells customers, and when are we legally required to disclose? Single points of failure: the entire response depends on one person who happens to be unreachable.

None of these are pleasant to discover, but discovering them in a conference room over coffee is infinitely better than discovering them during a live breach.

Making it worthwhile

A few habits make a tabletop pay off. Choose realistic scenarios relevant to your actual risks — ransomware, a phished executive, a leaked credential, a key vendor breached. Include the non-technical decision-makers, because real incidents are as much about business and legal calls as technical ones. Capture every gap uncovered as a concrete follow-up action with an owner, and actually close those actions before the next exercise. And run them regularly, because plans, people and systems drift.

The organizations that handle incidents calmly are almost never the ones with the fanciest tools. They are the ones who have talked through the crisis before, found their gaps in the quiet, and fixed them — so that when the real alarm sounds, it feels less like a catastrophe and more like a rehearsal they have run before.

Choosing a scenario

A good scenario is realistic, relevant and slightly uncomfortable. Base it on threats that genuinely affect your organization: ransomware encrypting file servers, a compromised email account used to request payments, a stolen laptop containing customer data, a cloud storage bucket exposed to the internet or a key supplier suffering a breach. Recent incidents in your industry are a rich source of ideas. Avoid scenarios so exotic that participants dismiss them, and avoid ones so simple that nobody needs to make a decision.

Who should participate

Invite the people who would really be involved: technical staff who would investigate, managers who would make business decisions, someone responsible for communications and, for larger scenarios, legal, finance and leadership. A facilitator runs the exercise and introduces new information, and an observer takes notes on decisions, delays and questions. Keep the group small enough for everyone to contribute — a dozen people is often the practical maximum for a productive discussion.

Designing injects

The scenario unfolds through injects: pieces of new information introduced at intervals that change the situation and force decisions. An exercise might begin with a single alert about unusual sign-ins, then reveal that a mailbox rule is forwarding messages, then that a customer has received a fraudulent invoice, and finally that a journalist is asking questions. Each inject should prompt specific decisions: who to inform, what to contain, what to tell customers and what evidence to keep. Prepare a few optional injects to increase pressure if the discussion moves too quickly.

Running the session

Begin by setting expectations: this is a safe environment to discover gaps, not a test of individuals. Present the scenario, introduce injects at a steady pace and ask participants to describe exactly what they would do, who they would contact and which tools or documents they would use. Encourage them to open the real playbook, contact lists and systems documentation during the exercise; discovering that a phone number is out of date is a valuable finding. Keep the session to a defined length — two hours is often enough — and leave time at the end for discussion.

The hot wash and the report

Immediately after the exercise, hold a short discussion — often called a hot wash — while impressions are fresh. Ask what went well, where people were unsure, which information was missing and which decisions were difficult. Within a few days, write a brief report listing the findings, the agreed improvements, their owners and deadlines. A report that leads to concrete changes is the real product of the exercise.

Common findings

Certain gaps appear again and again in tabletop exercises: nobody is sure who has authority to shut down a critical system, contact details for suppliers or insurers are outdated, backups have never been restored under realistic conditions, logs needed for the investigation are not retained long enough, the communication plan assumes email is available, and nobody knows the deadlines for regulatory notification. Each of these is cheap to fix once discovered and expensive to discover during a real incident.

Frequency and progression

Run exercises regularly — at least once or twice a year — and vary the scenarios so that different parts of the organization are tested. Start with simple, discussion-based exercises and progress toward more demanding formats: longer scenarios, surprise timing or functional exercises in which some actions are actually performed, such as restoring a backup or contacting a supplier. Track whether improvements from previous exercises were completed and whether the same gaps reappear.

Exercising with suppliers and partners

Many incidents involve outside parties: a hosting provider, a software supplier, a managed service partner or a customer. Consider joint exercises with key partners to test how information would flow between organizations, who would decide what and how quickly each side could act. These exercises often reveal mismatched expectations in contracts and support agreements that are far better resolved in a meeting room than during a crisis.

Making it worth everyone's time

The value of a tabletop exercise depends on preparation and follow-through. Prepare the scenario carefully, invite the right people, keep the atmosphere constructive and, above all, act on the findings. An exercise that produces three fixed gaps is a success; one that produces a long list of findings nobody addresses is a missed opportunity.

Scaling exercises to your organization

Tabletop exercises work for organizations of any size. A small company can run a meaningful exercise with four or five people around a table for an hour, using a simple scenario and the real contact list and backup procedures. Larger organizations may run separate exercises for technical teams and for executives, then a combined exercise once a year. What matters is not scale but realism: the scenario should reflect your systems, your suppliers and your obligations, and participants should be the people who would really act.

Exercising the executive layer

Executives make the decisions that shape an incident's outcome: whether to shut down operations, how to communicate with customers and regulators, whether to involve law enforcement and how to respond to extortion demands. An exercise focused on these decisions — with technical details summarized rather than debated — prepares leadership to act quickly and consistently. Include questions about business continuity, financial impact, legal advice and public statements, and make sure the people who would sign off on them are in the room.

The bottom line

A tabletop exercise is one of the cheapest and most revealing security activities an organization can run. It costs a few hours, needs no special tools and reliably exposes the gaps that would hurt most during a real incident. Choose realistic scenarios, involve the right people, keep the tone constructive and turn every finding into an owned, dated improvement.

To get started, pick one scenario from the list above, block two hours in the calendars of the people who would respond, bring printed copies of the playbook and contact list, and run it. The first exercise is always the most revealing, and its findings will shape a much stronger response plan.