Tabletop exercises that test the plan before an attacker does.

1. 01

   Objective setting

   We agree what you are testing. A tabletop that tries to test everything tests nothing — a session focused on ransomware decision-making runs very differently from one testing regulatory notification timelines.

2. 02

   Scenario development

   Scenarios are built around your environment, your systems and your actual threat profile, and injected in stages so participants respond to developing information rather than a summary. A generic scenario gets generic answers.

3. 03

   Participant selection

   The value depends on who is in the room. Technical responders alone will not surface the legal, communications and executive decisions that dominate a real incident. We advise on who should attend and, where useful, run separate executive and technical tracks.

4. 04

   Facilitated exercise

   A facilitator drives the scenario and injects complications — a system that will not restore, a journalist calling, a regulator's clock running. The role is to surface where decision authority is unclear, which is the most common real-world failure.

5. 05

   Hot wash

   Immediately after, while it is fresh: what worked, what did not, what nobody knew. This session is consistently where the most valuable findings come out, and it depends on people being willing to say a plan did not work.

6. 06

   Report and plan revisions

   You get a report of the gaps found and, more usefully, concrete revisions to your incident response plan and playbooks. An exercise that ends in a report nobody actions was an expensive meeting.

Common questions

What is an incident response tabletop exercise?

An incident response tabletop exercise is a facilitated, discussion-based simulation of a security incident. A facilitator walks your team through a realistic scenario, such as ransomware or business email compromise, and the team works through how they would detect, decide, communicate, and respond. It surfaces gaps in your plan, roles, and tooling, and builds the muscle memory that makes a real response faster and calmer.

How often should we run tabletop exercises?

Most organizations run a tabletop exercise at least annually, and after any major change to the team, environment, or threat landscape. Frameworks and cyber insurers increasingly expect regular exercises. SubRosa can run executive and technical sessions and provide a gap analysis after each.

Who should attend a tabletop exercise?

More than the security team. Real incidents are dominated by legal, communications and executive decisions — whether to pay, what to tell customers, when a regulator's clock starts — and none of those surface if only technical responders are in the room. Where the group is large or the decisions differ sharply, we run separate executive and technical tracks.

How long does an exercise take?

Typically two to four hours for the session itself, plus scenario development beforehand and a hot wash immediately after. The preparation and the follow-up are where most of the value is; the session is the part that surfaces it.

How often should we run one?

At least annually, and after any significant change to your environment, your team or your obligations. Several frameworks expect regular testing of the incident response plan, and a tabletop is the most practical way to evidence it.

What happens afterwards?

You get the gaps found and, more usefully, concrete revisions to your incident response plan and playbooks. An exercise that ends in a report nobody actions was an expensive meeting — the deliverable is the changed plan, not the observation.