Tabletop Exercises Guide: Rehearsing Your Incident Response

A tabletop exercise is a discussion-based simulation where stakeholders walk through a hypothetical security incident scenario, testing their understanding of the incident response plan, communication procedures, and decision-making processes. Unlike technical exercises that test tools and automation, tabletop exercises test people, processes, and organizational readiness.

Why Tabletop Exercises Matter

An incident response plan that has never been tested will fail when activated. Tabletop exercises reveal gaps that are invisible on paper: unclear escalation chains, missing contact information, conflicting role assignments, communication breakdowns between departments, and decisions that require authority not granted in the plan.

The exercise environment provides psychological preparation as well. Participants who have walked through a ransomware scenario mentally are less likely to panic during a real incident. They have already considered the decisions, trade-offs, and communication challenges in a low-pressure setting.

Planning the Exercise

Define objectives. What are you testing? The communication chain? Decision authority for ransomware payment? Coordination between IT, legal, and communications? Public disclosure timing? Each exercise should have 2-3 specific objectives.

Select the scenario. Choose a realistic scenario relevant to your organization’s threat landscape. Common scenarios include ransomware encrypting critical systems during a holiday weekend, business email compromise directing a fraudulent wire transfer, a data breach with regulatory notification requirements, or a vendor compromise affecting your supply chain.

Identify participants. Include all stakeholders who would be involved in a real incident: IT/security leadership, executive management, legal counsel, communications/PR, HR, operations, and the incident response team. Including external parties like your cyber insurance carrier, legal firm, or incident response retainer improves realism.

Develop injects. Injects are new pieces of information introduced during the exercise that force participants to adapt: “Media is now reporting the incident,” “The attacker has contacted you with ransom demands,” “A regulatory body has requested information,” or “A second system has been compromised.”

Running the Exercise

A facilitator presents the scenario and guides discussion through each phase. Participants describe what they would do at each stage without actually performing technical actions. The facilitator introduces injects at planned intervals to test adaptability.

Duration: 2-4 hours for a comprehensive exercise. Schedule during business hours with all participants committed for the full duration. Record the session or assign a dedicated note-taker to capture decisions, questions, gaps, and action items.

After-Action Review

Document findings within one week while memory is fresh. Categorize findings into strengths, areas for improvement, and critical gaps. Assign remediation actions with owners and deadlines. Update the incident response plan based on findings. Schedule the next exercise.

For the incident response plan these exercises test, see our incident response plan guide. To understand the attacks your scenarios should model, explore our ransomware prevention guide.

Exercise Scenario Library

Build a library of scenarios relevant to your organization that can be rotated across exercises:

Ransomware during peak season: Tests response when business pressure makes downtime most costly.

Insider data theft by departing employee: Tests coordination between HR, security, and legal.

Third-party vendor breach exposing customer data: Tests vendor communication, regulatory notification, and customer response.

CEO email compromise targeting finance: Tests BEC awareness and payment verification procedures.

DDoS attack during product launch: Tests coordination between security, engineering, and communications under public scrutiny.

Vary scenarios between exercises to test different aspects of your response capability. After each exercise, update the scenario library with lessons learned and new threat intelligence.

Engaging Non-Technical Participants

The most valuable tabletop exercises include participants from outside the security team: legal counsel, communications, HR, finance, and executive leadership. These participants often reveal gaps invisible to technical teams: Can we communicate with customers if email is down? Who authorizes a public statement? Does our cyber insurance policy cover this scenario? What are our regulatory notification deadlines? Non-technical insights frequently produce the most actionable findings.