How a Cybersecurity Tabletop Exercise Actually Works

The exercise starts long before anyone sits down at the table. We run a scoping call with your point of contact to understand the landscape. Industry. Technology stack. Team structure. Reporting lines. Who makes decisions when the CISO is on a plane and unreachable.

We review your existing incident response plan. Most organizations have one. Most have never tested it under pressure. We read it not to judge it but to understand what your team believes the plan says versus what the plan actually requires. That gap between belief and documentation is where tabletop exercises deliver their highest value.

From the scoping call we design a custom scenario based on your actual threat profile. A manufacturing firm with OT/IT convergence gets a different scenario than a healthcare network managing patient records. A financial services company dealing with wire fraud and regulatory reporting deadlines faces different pressures than a SaaS platform managing customer data across jurisdictions. We do not use generic templates. The scenario reflects threats that are plausible for your organization specifically.

We then select participants. The right room includes IT, legal, HR, executive leadership and communications. The wrong room is just the security team talking to themselves. Incident response is a business function. The exercise must reflect that reality.

Finally we confirm logistics. Room booking or video conference link. Duration (2 hours standard). Ground rules. No phones. No email. Full attention. This is a simulation and it demands the same focus as the real thing.

This is where a Sherlock Forensics tabletop separates itself from a compliance checkbox exercise. When a team gives a comfortable answer, we push past it.

Every team has a plan until the plan depends on a single person who is unavailable. Every team has a backup strategy until the backup requires credentials that three people share and nobody has documented. Every team knows who to call until the person they need to call is the one whose account was compromised.

The probing technique forces teams past their comfortable assumptions and into the reality of execution under pressure. We are not trying to embarrass anyone. We are simulating what a real incident does naturally: it finds the weakest link in your response chain and breaks it at the worst possible moment.

This is the difference between reading questions from a checklist and running a tabletop that produces actionable intelligence. The checklist confirms that a plan exists. The probing technique tests whether the plan actually works when the people responsible for executing it are stressed, tired or unavailable. NIST's SP 800-84 Guide to Test, Training, and Exercise Programs outlines why facilitated discussion-based exercises produce better outcomes than scripted walkthroughs.

Not all tabletop exercises are created equal. The difference between a useful exercise and a wasted afternoon comes down to facilitation quality, scenario design and the willingness to create real discomfort in the room.