Cybersecurity
Tabletop exercises
We put your leaders and responders in a realistic scenario and ask what they would do. The goal is not to catch anyone out, it is to find unclear authority, missing information and untested assumptions while there is time to fix them.
The problem this service solves
Plans fail on the details nobody discussed. Who can decide to take the online store offline? Does legal need to approve the first customer message? What if the person with the break-glass password is on leave? A tabletop surfaces those questions in a room, rather than on the worst day.
The scenario is built from your environment and threats, so the discussion deals with your systems, not a generic case.
What is in scope
-
Scenario design
Develop a realistic storyline using your technology, business and threat profile.
-
Facilitation
A neutral facilitator introduces developments, called injects, and probes decisions.
-
Audience options
Executive crisis decisions, technical response, or a combined exercise.
-
Observation
Notes on decisions, assumptions, gaps in information and communication.
-
After-action report
Findings, recommended changes, owners and timeline.
How the work runs
Prepare
Design.
-
1
Objectives and participants
Decide what you want to learn and who needs to be in the room.
-
2
Scenario and injects
Draft the timeline and the surprises that test decisions.
Run
Facilitate.
-
3
Exercise
Walk through the scenario, with discussion at each stage.
-
4
Hot wash
Immediately gather participant reactions.
Follow up
Convert to action.
-
5
Report
Written findings and recommendations.
-
6
Action tracking
Agree owners and review progress later.
What you receive
- Scenario and facilitator materials
- Facilitated session
- After-action report
- Action register with owners
- Optional follow-up session
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Participants available for the session
- The existing plan, if any
- A short description of critical systems and recent changes
What this service is not
- A technical attack simulation (see red or purple teaming)
- An evaluation of individuals
What changes afterwards
- Decision authority is clear
- Information needs and gaps are known
- Executives have practiced the first hours
Questions people ask
Who should attend?
For executives: business leaders, legal, communications, HR and IT leadership. For technical: security, IT operations, cloud and application owners. Combined sessions work best after separate ones.
How often should we run one?
At least annually, and after major changes. Many teams alternate executive and technical exercises.
Related
-
Incident response planning
Write plans and playbooks your team can use at 2 a.m., based on NIST SP 800-61 Rev 3 and tested against realistic scenarios.
-
Ransomware readiness
Assess whether you could detect, contain and recover from ransomware, and fix the weak points: identity, backups, segmentation and response.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response