Run a Cybersecurity Tabletop Exercise: Step-by-Step

This guide walks you through planning and running a tabletop exercise (TTX) for cybersecurity incident response. A TTX is a discussion-based session where your team walks through a realistic incident scenario to test your response plan, identify gaps, and improve coordination—without actually deploying tools or affecting systems. It’s a low-cost, high-value way to build muscle memory for when a real incident hits. Before you start, you need a basic incident response plan (even a draft), a scenario relevant to your organization, and buy-in from leadership to dedicate 1–2 hours for the session.

What You’ll Need

• A facilitator (can be internal or external) who knows the incident response plan and can keep the discussion moving.
• A scenario document—a realistic, plausible incident (e.g., ransomware, phishing, insider threat) with injects (new pieces of information) prepared in advance.
• A copy of your incident response plan, communication templates, and any relevant policies (e.g., data breach notification, escalation).
• A room or virtual meeting with a whiteboard or shared digital workspace (e.g., Miro, Mural, or a shared doc) to capture notes and action items.
• Participants: key roles from IT, security, legal, PR/communications, HR, and executive leadership. Assign roles or have them play themselves.
• A timer or agenda to keep the session on track.
• Notetaker to record decisions, gaps, and action items.

Step-by-Step

1. Define objectives. Start by writing down 2–3 specific goals for the exercise. For example: “Test our ransomware response procedures� or “Evaluate communication between IT and legal during a data breach.� Clear objectives help you design the scenario and measure success.
2. Choose a scenario. Pick an incident that is realistic for your organization—think about your industry, size, and recent threats. Common scenarios include phishing leading to credential compromise, ransomware encrypting critical servers, or a malicious insider exfiltrating data. Avoid overly exotic scenarios; the goal is to test your actual plan, not to stump your team.
3. Develop injects. Prepare a timeline of events that you’ll reveal during the exercise. Each inject should be a piece of information that changes the situation—e.g., “The attacker has posted stolen data on a public forum� or “The CEO’s email account has been compromised.� Write these on separate cards or slides so you can reveal them one at a time.
4. Invite participants. Send calendar invites with a clear agenda and pre-reading (like the incident response plan). Include all key roles—do not forget legal and PR, as they are often overlooked but critical in a real incident. Aim for 6–12 people; too many can make discussion unwieldy.
5. Set ground rules. At the start of the session, explain that this is a no-fault exercise—the goal is to learn, not to assign blame. Emphasize that participants should speak up, ask questions, and challenge assumptions. Also clarify that the exercise is a discussion, not a technical simulation; no systems will be touched.
6. Brief the participants. Give a 5-minute overview of the scenario’s starting point. For example: “At 9:00 AM, your security team notices unusual network traffic from a server that stores customer data. What do you do first?� Then, ask the team to walk through their response step by step, referencing the incident response plan.
7. Reveal injects. As the discussion progresses, introduce each new piece of information at planned intervals. After each inject, ask: “What does this change? What actions do you take now?� Encourage the team to think about decisions, communications, and resource allocation.
8. Facilitate discussion. Your facilitator’s job is to keep the conversation moving, ensure all voices are heard, and probe for deeper thinking. Ask questions like “Who is responsible for that decision?� or “What would you do if that person is unavailable?� Redirect tangents back to the scenario.
9. Capture everything. The notetaker should record key decisions, questions, and gaps in the plan. Use a whiteboard or shared doc to track “what went well� and “what needs improvement� in real time. This will be your primary output for the after-action report.
10. Wrap up with a hotwash. In the last 15–20 minutes, lead a debrief. Ask the team: What worked? What didn’t? What would you do differently? Summarize the top 3–5 gaps or issues identified. This is the most valuable part of the exercise—make sure you leave time for it.
11. Write an after-action report. Within a few days, circulate a summary that includes the scenario, key findings, and a list of action items with owners and deadlines. This report turns the exercise into tangible improvements to your incident response plan.
12. Schedule follow-up. Plan to re-run the exercise after you’ve implemented changes, or at least annually. Tabletop exercises are most effective when they are part of a continuous improvement cycle.

Common Mistakes

• Making it a technical deep-dive. The exercise is about process and communication, not about the technical details of malware analysis. Keep the discussion at the decision-making level.
• Letting one person dominate. A strong personality can steer the conversation. The facilitator must actively draw out quieter participants and manage the dominant voice.
• Skipping the hotwash. If you run out of time, you lose the chance to capture lessons learned. Always reserve time for the debrief.
• Not involving legal/PR early. In a real incident, you’ll need them. Include them in the exercise so they understand their role and you can test communication paths.
• Using a scenario that’s too vague or too extreme. A scenario that’s too vague leads to generic answers; one that’s too extreme (e.g., a nation-state attack on day one) may cause participants to disengage. Aim for plausible and challenging.

Tips

• Start small. If this is your first exercise, keep the scenario simple and the group small. You can always expand later.
• Use a neutral facilitator. Someone who isn’t part of the incident response team can ask tougher questions without bias.
• Time-box each inject. Allocate 10–15 minutes per inject to keep the pace brisk.
• Encourage “what ifâ€� thinking. Ask participants to consider how their actions would change if the inject had a different twist (e.g., the attacker is an insider).
• Record the session. With permission, record the discussion so the notetaker can focus on listening. Just be sure to follow your organization’s recording policies.

Troubleshooting

If the exercise stalls or goes off track, try these adjustments:

• No one is talking. Break the ice by asking a direct question to a specific person, or start with a “round-robinâ€� where each participant shares their first action.
• The discussion goes too deep into technical details. Gently redirect by asking “What decision does the team need to make right now?â€� or “Who is the decision-maker for this?â€�
• Participants are treating it as a test. Remind them again that the goal is to find gaps, not to pass or fail. Emphasize that every identified gap is a win.
• You run out of time. If you haven’t reached the hotwash, stop the scenario and go straight to the debrief. You can always continue the exercise in another session.
• The scenario feels unrealistic. If participants are questioning the plausibility, adapt on the fly—adjust the injects to be more aligned with your environment. The facilitator should have flexibility.

Frequently Asked Questions

How long should a tabletop exercise last?

Typically 1–2 hours. A focused session with 6–12 participants and 3–5 injects fits well in 90 minutes. Longer exercises risk losing engagement.

Who should be the facilitator?

Ideally someone experienced in incident response and facilitation, but not directly involved in the day-to-day operations of the team being tested. This could be an internal security manager from another department or an external consultant.

Do we need to simulate actual systems?

No. A tabletop exercise is discussion-based. You may use diagrams or a whiteboard, but you should not touch real systems. That’s what a full simulation exercise is for.

How often should we run a tabletop exercise?

At least once a year, but many organizations run them quarterly or after major changes (new systems, new regulations, or after a real incident). Regular practice keeps the plan fresh.

What if we don’t have a formal incident response plan?

You can still run a TTX—it will actually help you build your plan. Use the exercise to walk through a scenario and note what procedures you’re missing. The output can be the basis for your first formal plan.

How do we measure success?

Success is not about “passing� but about identifying gaps and improving. Measure success by the number and quality of action items generated, and by whether participants better understand their roles after the exercise.

Related

• Water Heater ROI Calculator: Estimate Payback and Savings
• Resistance Voltage Calculator: Find Voltage with Ohm’s Law
• US Water Heater Calculation: Estimate Tank Size