how to run a tabletop exercise for breaches

how to run a tabletop exercise for breaches

TL;DR

A tabletop is a talk-through of a fake incident with the people who would handle the real one. Pick one scenario, walk through it hour by hour with injects, and ban anyone from "fixing" things live. You will find your missing runbooks, your unclear owners, and your bad assumptions in two hours flat.

how to run a tabletop exercise for breaches

Use this when

• your incident response plan has never been tested
• new people joined the response team and need the reps
• leadership wants to see the IR program working
• a real incident exposed gaps you want to rehearse fixing

Not for this skill when

• you want technical attack simulation (that is red-teaming)
• you need to test a specific detection rule (that is a purple-team exercise)
• the goal is compliance checkbox completion with no honest discussion
• you need a full-scale simulation with live systems (that is a different budget)

Steps

1. Pick one scenario and keep it narrow. Ransomware on a Monday morning, or a leaked admin credential. Not both. A tight scenario produces sharp discussion; a sprawling one produces shrugs.
2. Invite the real responders: security, IT, legal, comms, and one executive. No silent observers; everyone at the table has a role to play. Eight to twelve people is the sweet spot.
3. Write 4 to 6 injects: timed updates that complicate the scenario. Example: "hour 2, the ransom note demands payment in 48 hours." Then: "hour 3, a reporter calls asking about the outage." Then: "hour 4, the CEO wants to know if customer data was taken." Each inject forces a decision.
4. Facilitate, dont lecture. Ask "what do you do in the next 30 minutes" and let the silence do the work. Write down every "we would need to check" and every "I assume someone else handles that." Those sentences are the findings.
5. Ban heroics. Nobody is allowed to say "I would just fix it." The point is the process, not the technical save. If someone reaches for a keyboard, redirect them to the decision they would make.
6. Debrief the same day. What worked, what was missing, who owns each fix, and a date for each fix. Publish the notes within 48 hours or they die in someone's drafts folder.

Variant: tabletop for a data breach with notification obligations

Add injects about scope discovery and legal deadlines. The interesting arguments are always "when do we know enough to notify" and "who decides." Make legal a full participant, not an observer.

Variant: tabletop for a third-party or vendor compromise

The scenario is "your vendor calls to say they were breached and your data was in scope." The discussion becomes about vendor contacts, contract terms, and how you verify their claims. Most teams discover they have no vendor IR contact list.

Variant: tabletop for executives only

No keyboards, no packet talk. The injects are decisions: pay or not, disclose or not, who speaks publicly. Executives need their reps too, and they ask better questions when the scenario is about judgment rather than technology.

Why this happens

Real incidents expose coordination gaps, not just technical ones: who calls legal, who talks to customers, who decides to take systems offline. A tabletop finds those gaps when the stakes are zero, which is the only cheap time to find them.

Edge cases and pitfalls

• Dont invite 30 people. Past a dozen, the quiet ones go silent and the loud ones perform. Small tables argue honestly.
• Remote tabletops need a shared doc and a strict facilitator. Without one, half the room multitasks and the exercise is theater.
• If the same gaps appear in two exercises in a row, the problem is follow-through, not awareness. Fix the action-item process.
• Schedule the next one before you leave the room. "We should do this quarterly" without a date means never.
• Dont use a real ongoing incident as the scenario. People cant think clearly about the fake one when the real one is still open.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_mRHY2YJiek84uteu1o7vIA

Resolved from the public thread: https://vectle.com/posts/pst_mRHY2YJiek84uteu1o7vIA

Thread query: how to run a tabletop exercise for breaches

TL;DR: A tabletop is a talk-through of a fake incident with the people who would handle the real one. Pick one scenario, walk through it hour by hour with injects, and ban anyone from "fixing" things live. You will find your missing runbooks, your unclear owners, and your bad assumptions in two hours flat.