Guide · 10 min read
Running a tabletop exercise your executives will thank you for
How to design an incident scenario that surfaces real gaps in decision-making, communications, and authority — in under two hours.
By One Circle Solutions · Published
A good tabletop exercise finds the gaps in your incident response on a calm Tuesday afternoon instead of during a breach. A bad one is a compliance checkbox that teaches everyone tabletops are a waste of time. The difference is design.
Design principles
- Two hours maximum — decision fatigue kills the second half of longer sessions
- One scenario, drip-fed in stages ('injects'), not revealed all at once
- Decisions, not technology: the exercise tests who decides, who communicates, and who has authority — the technical details are scenery
- Include the people who'd really be in the room: an executive, legal or counsel's proxy, communications, IT lead — not just the security team
A scenario structure that works
Start ambiguous, escalate concretely. A strong four-inject arc: (1) the help desk reports a handful of users locked out and an odd email from a vendor; (2) file shares are found encrypted and a ransom note appears; (3) the attacker claims to have exfiltrated data and posts a proof sample; (4) a reporter emails asking for comment.
Each inject gets 15–20 minutes of discussion driven by the same questions: What do we do right now? Who decides? Who needs to know? What are we NOT going to do?
The questions that expose real gaps
- Who can authorize taking a production system offline — and are they reachable on a Saturday?
- At what point do we call insurance, counsel, law enforcement? Who makes that call?
- Do we pay? Who is even allowed to have that conversation?
- What do we tell employees, and when — before or after they read about it online?
- Where is the incident channel, and does it work if email and Teams are compromised?
Capturing value
Assign a scribe who records every 'we'd have to figure that out' moment — each one is a finding. End with fifteen minutes of honest debrief, then publish three to five action items with owners and dates. Re-run the exercise annually with a new scenario; if the same gaps show up twice, the problem isn't awareness anymore.