A good tabletop should ruin your day

Most organisations either haven’t run a cyber incident exercise or are far more confident in them than they should be. Tabletop exercises are widely used to prepare for cyber incidents, yet many fail to test what actually matters. As a result, organisations build confidence in scenarios that do not reflect the reality of a live incident. 

Across industries, a consistent pattern emerges in cyber incident exercises. Scenarios are controlled, participants are comfortable, and outcomes are predictable. The focus is often placed on high-profile decisions, such as whether to pay a ransom, rather than the earlier moments that shape the outcome. 

In practice, the most important decisions happen well before that point. It is the analyst who hesitates to escalate an alert, the executive asking for answers to the wrong questions, and the disconnect between legal, technical, and customer teams trying to respond at the same time. These are the moments where incidents begin to unravel, yet they rarely appear in standard exercises. 

Most tabletop exercises also begin too late. They start after an incident has already been declared, with the response team activated and the process underway. Very few organisations test how they move from business as usual into an active incident response. 

That transition is rarely straightforward. Alerts may be unclear, escalation paths may not be followed, and key contacts may not be reachable. It is not always obvious whether escalation is justified or who should make that call. While most organisations have defined thresholds for escalation, very few have tested how those thresholds work in practice. 

This gap between detection and declaration is where time is lost and risk increases. It is also where decisions are made without enough information or coordination. 

There is a reason many incident response engagements begin late in the week. Organisations often give themselves time to figure it out internally before escalating for external support. For a behaviour that occurs so frequently, it is rarely identified or addressed in typical exercises. 

Experience drawn from real incidents shows a clear divide between what organisations rehearse and what incidents actually demand. Exercises that feel smooth and controlled often reinforce assumptions rather than challenge them, creating a false sense of readiness. 

A good tabletop exercise should do the opposite. It should create pressure, expose weaknesses in communication and decision-making, and test whether escalation paths work as they would in practice. 

This is not about compliance. It is about understanding where preparation fails, and what needs to change to ensure an organisation can respond effectively when it matters. 

Who is this for: Executives, board members, CISOs, GRC professionals, legal counsel, and cyber incident responders. Anyone who would be in the room when a real incident unfolds, or responsible for the organisation that is.