Everyone has a plan until they get phished

The traditional incident response tabletop often suffers from "boardroom bias," favouring high-level theory over operational friction. To build genuine resilience, organisations must shift from scripted rehearsals to dynamic simulations that test how people and technology perform under genuine pressure. This session provides a strategic framework for turning static plans into high-stakes exercises that bridge the gap between executive decision-making and technical execution. By moving away from purely hypothetical discussions and integrating tangible elements like log analysis and investigative tasks, you can challenge technical teams and validate the data they rely on before a real crisis hits.

Key Session Topics

• Intelligence-Led Scenario Design:​Learn to convert external breach reports, intrusion theories, and AI-augmented attack vectors, including deepfake-authorized lateral movement, into tailored scenarios. We will cover how to map global attack patterns to your specific architecture to replay previous incidents and verify if your current defences actually hold up.
• The "Crawl, Walk, Run" Framework:​ Strategies for scaling from small, technology-specific "chunks" to organisation-spanning crises. This includes testing the "Silent Partner" scenario, where the breach originates at a critical SaaS or Supply Chain provider, forcing your team to manage third-party dependencies under stress.
• Simulating High-Stakes Friction:​ How to inject variables that test true resilience, including "failed fixes" that make situations worse, missing SMEs, broken tools, and information voids. We will also explore the "Human Element," demonstrating how to build a no-blame culture where a junior analyst feels empowered to correct an executive during a crisis.
• Navigating the "No-Win" Scenario:​Techniques for forcing decision-makers to handle "grey areas" where no objectively right answer exists. This includes managing the "War of Narrative" when attackers leak data to social media mid-exercise, forcing PR and Legal to react to public pressure while the technical team is still triaging.
• Dynamic Facilitation and Executive Flexibility:​ Using a structured "run sheet" to manage stakeholders, allowing the scenario to pivot effectively when teams hit dead ends.
• Real-Time Feedback Loops:​Why you should not wait two weeks for a summary report. Learn how to capture findings and improvement ideas in the moment, while the adrenaline is high and the experience is fresh.

The true measure of a tabletop exercise is not a checkmark on a compliance audit; it is the confidence gained by a team that has already faced the impossible in a controlled environment. By introducing realism, technical depth, and the messy unpredictability of a real-world breach, you transform your Incident Response Plan from a dusty document into a functional shield. Attendees will walk away with a modular toolkit to design exercises that are engaging, realistic, and capable of turning theoretical strategy into a battle-tested operational reality.