How To Run a Cybersecurity Tabletop Exercise

Imagine it’s a busy Monday morning, and a ransomware attack hits your business. Employees suddenly can’t access files. Your IT team discovers suspicious encryption activity across the network. Your CEO wants to know how long the company could be down. A major customer wants to know whether their data is safe.

Then, someone asks a deceptively simple question: Who’s in charge here?

A cybersecurity tabletop exercise is a discussion-based simulation in which employees work as a team to walk through a hypothetical cyber incident and practice how the organization would respond. Without creating an actual cyber incident, the exercise helps you test existing incident response procedures, responsibilities, communication processes, and business decisions.

Think of it as a fire drill (or, where we’re located in the Midwest, a tornado drill) for your cyber incident response plan, minus all the alarms, stairs, and evacuation.

In a typical cybersecurity tabletop exercise, a facilitator will introduce a scenario, such as ransomware or business email compromise (BEC). The exercise’s participants will then work through the simulation using the processes and resources they actively have on hand.

Here are a few common issues you might discover:

These are exactly the types of problems you want to uncover during a cybersecurity tabletop exercise. Finding these issues in the simulated attack gives your team time to correct them before a real incident forces an immediate decision.

A tabletop exercise primarily tests your people, processes, and decision-making through a discussion.

Other cybersecurity tests evaluate different parts of your security program:

Each test can reveal something slightly different about your cybersecurity posture. For example, endpoint detection and response (EDR) might successfully detect ransomware. Your tabletop exercise asks, “What happens next?” Who receives the alert? Who determines whether affected devices should be quarantined? When does leadership get involved?

Those questions reveal whether your organization can move from detection to a coordinated response without losing valuable time.

Your tabletop exercise should include the people who would make decisions or perform important tasks during the incident you’re testing.

Your exact list of participants will be unique to your organization’s specific scenario. Most cybersecurity tabletop exercises include:

It’s important to note that external parties don’t necessarily need to sit through every exercise. our team should, however, know when those resources need to be involved and how to reach them quickly.

A useful incident response tabletop exercise needs enough structure to keep participants focused while leaving room for unexpected questions.

We’ve put together a simple, 7-step framework your business can use to test its incident response plan.

Step 1: Decide What You Want To Test

With a cybersecurity tabletop exercise, it’s important that you start with a specific objective. Trying to test your entire cybersecurity posture in one afternoon can quickly make the exercise unwieldy and out of hand.

Instead, focus on one part of your response. Some examples you may want to test include:

Consider the risks your team recently uncovered during a cybersecurity risk assessment or quarterly IT review. If your organization has specific concerns about ransomware or phishing, build the exercise around those threats rather than choosing an unrelated or nonspecific scenario.

Step 2: Choose a Realistic Cyber Incident for Your Business

You need to keep the details believable and reasonable. The scenario doesn’t need to be something out of a Hollywood sci-fi blockbuster—it should ask stakeholders, “what would we actually do?”

For example, a construction firm could simulate an employee’s Microsoft 365 account being compromised and used to send fraudulent payment instructions. A health care organization might test ransomware that makes shared client files unavailable.

Step 3: Invite the People Who Would Actually Respond

When you’re running an exercise, it’s essential to match participants to the actual scenario you’re testing.

A ransomware tabletop exercise might require leadership, IT, operations, communications, and your MSP. A business email compromise scenario could place greater emphasis on Accounting and Finance.

It’s critical that you also assign a facilitator. This role will present the scenario, ask follow-up questions, and keep the discussion moving. Additionally, they should document all unanswered questions and observations (or assign someone to take notes).

Step 4: Establish Ground Rules

A cybersecurity tabletop exercise needs to test your current processes—not just people’s ability to produce the “right” answer on the spot. Instead, ask participants to respond based on what they could realistically do today:

All these moments provide useful information for improving your incident response plan.

Step 5: Walk Through the Scenario

Reveal the incident gradually so participants must respond as new information becomes available.

For a ransomware scenario, you might begin with:

8:15 a.m.: Several employees report they can’t open files on a shared drive.

Ask the group:

Then move forward.

8:35 a.m.: IT identifies suspicious encryption activity on multiple devices.

Ask:

Continue adding information as the exercise develops. The goal isn’t to trick participants. ou’re looking for places where your current cyber incident response plan provides clear direction and where your team becomes uncertain about what to do next.

Step 6: Document All the Gaps You Find

During the exercise, you want a note-taker to write down issues as they arise.

Pay particular attention to communication—you may discover outdated phone numbers, unclear escalation procedures, missing vendor information, or uncertainty about cyber insurance requirements.

If ransomware takes Microsoft 365 offline, for example, how will your incident response team communicate? If the answer is “We’ll send an email,” you’ve found something worth addressing.

Also, document what worked. Existing procedures that participants could follow confidently can help you understand where your incident response planning is already effective.

In this scenario, at 8:15 on a Monday, several employees of a 100-person nonprofit organization report that documents on a shared drive won’t open. IT begins investigating the issue and discovers signs of ransomware.

Ask the group:

Then, introduce a new piece of information: at 10:20 a.m., one of your largest customers calls after hearing that your systems are unavailable. They want to know whether their data has been compromised.

Now ask the group:

Notice that many of these questions have nothing to do with actually removing the malware—they’re about running a business during a cybersecurity incident. That’s why leadership and operations need to be included in your cybersecurity tabletop exercise (not just IT).

There isn’t one testing schedule that fits every organization. You should conduct cybersecurity tabletop exercises regularly, especially when meaningful changes could affect your organization’s incident response.

The objective is to keep your response process aligned with the business you operate today.

Your risk profile, regulatory obligations, cyber insurance requirements, technology environment, and internal resources can all affect your testing cadence. You should also consider another exercise after significant changes such as implementing major technology, changing key response personnel, updating your incident response plan, or discovering new risks.

It’s a good idea to rotate scenarios over time as well. A ransomware tabletop exercise might expose problems with business continuity. An exercise that focuses on BEC could reveal weaknesses in financial verification procedures.

For some organizations, it makes sense to facilitate cybersecurity tabletop exercises internally. Others can benefit from an outside perspective, particularly when internal IT teams already have a major role in the incident response process. An experienced cybersecurity or IT consulting partner can help develop realistic scenarios, facilitate discussions, challenge assumptions, and translate findings into practical improvements.

Outside facilitation can be especially advantageous for small and medium-sized businesses without a dedicated cybersecurity or IT team.

A partner can also help identify when a problem uncovered during the exercise points to a larger issue. Uncertainty about recovering critical files, for example, could indicate that your backup and disaster recovery strategies need additional testing. Confusion about how an attacker gained access could warrant a broader cybersecurity risk assessment.

High Touch Technologies works with businesses through Cybersecurity Services, Managed IT Services, and IT Consulting to help evaluate technology risks and improve cybersecurity readiness. Our team can help you look beyond the tabletop scenario and determine what changes could make your actual response stronger.

A written incident response plan gives your organization a starting point. A cybersecurity tabletop exercise shows you how that plan holds up when people begin asking difficult questions.

You may discover that employees know exactly whom to contact and what to do. You may also uncover an outdated phone number, unclear responsibility, or a critical decision nobody realized needed an owner. Either outcome gives you useful information before a real incident puts the process under pressure.

Review your current cyber incident response plan and choose one realistic scenario to test. Bring the people who would actually make decisions into the room. Document where the process slows down, then turn those observations into assigned improvements.

If you’re unsure how your organization would respond to ransomware, business email compromise, or another cyber incident, High Touch Technologies can help you evaluate your cybersecurity readiness and identify practical next steps before you have to make those decisions during a real attack.