Tabletop Exercises That Actually Prepare You for an Incident

Most tabletops are theatre. A senior person reads a scenario, the room talks through what they would do, nobody changes anything, and the postmortem is a one-pager that says "we are well prepared." The exercise was a checkbox. The team learned nothing.

Here is how to run one that is not theatre.

What a tabletop is actually for

A tabletop is a stress test of the incident response process. The point is to find the places where the process breaks under realistic conditions, fix those places, and document the fixes. The point is not to demonstrate that the team can talk through a scenario. The team can always talk through a scenario.

The mistake most programmes make is treating the tabletop as a performance. The team performs the response. The senior leadership observes the performance. The postmortem is a summary of the performance. Nothing has been tested, because the response was a performance and not an exercise.

The fix is to make the exercise an actual stress test. The team is given a scenario and is asked to respond as if the scenario were real. The response is timed. The response is measured. The response is captured. The postmortem is a list of the specific places where the response broke under the stress, and the specific changes that will be made to fix those places.

The difference between a tabletop and a real incident is that in a real incident, the response is the response. In a tabletop, the response is a rehearsal. The rehearsal is only useful if the rehearsal is honest. The rehearsal is only honest if the rehearsal is allowed to break.

The scenario

The scenario is the most important part of the exercise. A good scenario is one that the team has not seen before, that the team's environment has not been specifically hardened for, and that the team's process has not been specifically drilled for. A good scenario is a scenario that finds the places where the process is weak.

A bad scenario is one that the team has seen before, that the team's environment has been specifically hardened for, or that the team's process has been specifically drilled for. A bad scenario is a scenario that the team has been prepared to pass.

The scenario should be realistic. The scenario should be a credible threat that the team might face. The scenario should not be a worst-case apocalyptic scenario. The scenario should be a realistic incident in a real environment.

The scenario should also be a scenario that the team has not had a week to prepare for. The scenario should be presented at the start of the exercise. The team should not know the scenario in advance.

The timing

The exercise should be timed. The team is given the scenario and a clock. The clock starts. The team has a realistic amount of time to respond. A realistic amount of time is the amount of time that the team would have in a real incident. For a ransomware scenario, that is hours, not minutes. For a credential-stuffing scenario, that is minutes, not hours.

The timing matters because the timing is part of the stress. The team that has all the time in the world to respond is not the team that is going to be responding to the real incident. The team that has the realistic amount of time to respond is the team that is going to be responding to the real incident. The exercise should rehearse the realistic response, not the ideal response.

The timing also matters because the timing is part of the measurement. The team that responds in the realistic amount of time to a realistic scenario is the team that is ready. The team that does not respond in the realistic amount of time to a realistic scenario is the team that is not ready. The measurement is the postmortem.

The response

The response is the rehearsal. The team is asked to do the things that the team would do in a real incident. The team is asked to make the calls that the team would make in a real incident. The team is asked to communicate the way the team would communicate in a real incident.

The exercise is not the place to be polite. The exercise is not the place to defer to the senior person in the room. The exercise is the place to test the response under realistic conditions. If the response is to defer to the senior person, the exercise is testing the wrong thing. The exercise is testing the response, and the response is the team's response, not the senior person's response.

The response is captured. The capture is the documentation. The capture should be detailed enough that the postmortem can identify the specific places where the response broke.

The postmortem

The postmortem is the most important part of the exercise. The postmortem is the list of the specific places where the response broke, and the specific changes that will be made to fix those places. The postmortem is the thing that makes the exercise useful.

The postmortem is not the place to be polite. The postmortem is not the place to declare the exercise a success. The postmortem is the place to be honest about the places where the response broke, and the place to commit to fixing those places.

The postmortem has three parts. The first is the list of the specific places where the response broke. The second is the specific changes that will be made to fix those places. The third is the timeline for the changes.

The postmortem is the document that the senior leadership signs. The signature is the commitment. The commitment is the thing that makes the exercise useful.

The follow-up

The exercise is not useful unless the follow-up happens. The follow-up is the changes that the postmortem committed to. The follow-up is the changes that the team makes to the process, the documentation, the tooling, the detection rules, and the response procedures.

The follow-up is the part of the exercise that most programmes skip. The follow-up is the part of the exercise that is the most work. The follow-up is the part of the exercise that is the most important.

The follow-up should be tracked. The follow-up should have owners. The follow-up should have dates. The follow-up should be reviewed at the next tabletop. The follow-up is the loop that closes the exercise.

The honest answer

The honest answer is that most tabletops are not worth the time they take. The honest answer is that the few tabletops that are worth the time are the ones that are run as honest stress tests, with realistic scenarios, with timing, with capture, with postmortems, and with follow-up.

If you are running a tabletop, run it as an honest stress test. If you are not running it as an honest stress test, do not run it. The team will learn more from one honest tabletop than from a year of theatrical ones.