Incident Response Tabletop: Running an Exercise That Actually Helps

Welcome back. Today's episode is about tabletop exercises, and specifically how to run one that actually finds things. Most tabletops I've seen are theatre — everyone in the room nods, reads from the runbook, and walks out feeling prepared. Then the real incident happens and nobody can find the escalation contact. Let me show you how to make the exercise worth the hour.

Start with scenario design. A good tabletop scenario has three properties. It is specific, it is plausible, and it is uncomfortable. Specific means named systems, named people, real dependencies — not 'attacker gains access to the environment.' Plausible means it follows from your actual threat model and your actual architecture, not a Hollywood plot. Uncomfortable means it touches something you suspect is weak — an old integration, a team that rarely gets tested, a process nobody has rehearsed.

For example, a generic scenario is: 'Ransomware hits the file server.' A good scenario is: 'At two in the morning UTC, the monitoring team sees encryption activity on the primary document storage used by the legal team. The on-call identity engineer is on holiday. The backup of the legal share last completed successfully three weeks ago.' You see the difference. The first one lets everyone recite the playbook. The second one forces real decisions under real constraints.

Now facilitation. This is where most exercises fall apart. Your job as facilitator is not to solve the problem. It is to keep the clock moving and to ask 'what happens next.' Every time the room starts debating the technical details, you pull them back to the process. Every time someone says 'we would do X,' you ask 'who does X, how do they know to do X, where is X documented, and what if they are unreachable.' That is the entire job.

Keep the clock visible. Fifteen minutes per phase. Detection phase. Triage phase. Containment phase. Communication phase. Recovery phase. Post-incident phase. If a phase overruns, note why and move on. The overrun is data.

Now the questions. These are the ones that surface real gaps:

Who is on call right now, and what is the phone number? Nine times out of ten, someone in the room has to look it up. That is a finding.

Where is the incident bridge? What happens if the primary bridging tool is the thing that's compromised? Another finding.

Who legally needs to be told, and by when? For most organisations the answer involves regulators, contracts with customers, and data protection law. Most runbooks do not have that list. Finding.

Who decides to pay a ransom? Who has authority to shut down production? Who talks to the press? These are decisions that need named owners, written somewhere, agreed in advance. Not in the middle of the incident.

Where are backups, and when were they last verified? Not 'when did the backup job run' — when was a restore actually tested.

What do we do if the attacker is still in the network while we're responding? Most plans assume containment succeeds on first try. It doesn't.

Those questions alone will find more than any documentation review.

Finally, artefacts. Every tabletop should produce three things. A gap list: what did we discover we don't know, don't have, or haven't tested. An action tracker: each gap becomes an action with a named owner and a due date. And an updated runbook: the moments where the room got stuck get captured in writing so the next person through doesn't hit the same wall.

A few rules that make tabletops work. Always include someone who was not involved in writing the plan — they ask the naive questions, and the naive questions are the ones that find gaps. Invite business stakeholders for communication phases, not just the technical team. Record the session, or take detailed notes, because what feels obvious at the time is forgotten by the end of the week. And run them at least twice a year — preferably once a quarter for the high-risk scenarios.

One final thing. Nobody fails a tabletop exercise. The goal is to find gaps, and every gap found in the room is a gap that doesn't bite you at three in the morning. Celebrate the findings. Close the actions. Run the next one.

If this was useful, subscribe, and share it with whoever writes your IR plan. See you next episode.