Tabletop Exercises

How a tabletop exercise works

A well-structured tabletop exercise follows a consistent format:

Scenario design

The facilitator designs a realistic incident scenario based on threats relevant to the organisation. This might be a ransomware attack encrypting critical systems, a data breach involving customer records, a supply chain compromise affecting a key vendor, or a business email compromise targeting the finance team. Good scenarios are drawn from real-world incidents and tailored to the organisation’s sector and risk profile.

Phased injects

The scenario unfolds in phases, with new information (“injects”) introduced at each stage. For example:

• Phase 1 – the SOC detects unusual outbound traffic from a server containing customer data. What do you do?
• Phase 2 – investigation reveals the server has been compromised for three weeks. Attacker has exfiltrated 50,000 customer records. The regulatory clock starts. Who do you notify?
• Phase 3 – a journalist contacts your press office asking for comment. The attacker posts a ransom demand on a leak site. What is your public statement?

Each phase forces participants to make decisions, assign responsibilities, and confront trade-offs. The facilitator probes assumptions: “Who makes the call to pay or not pay the ransom? What if your CEO is on holiday? Where is the incident response plan – has anyone read it recently?”

Debrief and gap analysis

After the scenario concludes, the facilitator leads a structured debrief. This identifies gaps in the incident response plan, unclear roles and escalation paths, missing capabilities (such as forensic readiness or media handling), and decisions that would have delayed response in a real incident. The output is typically a written report with prioritised recommendations.

Tabletop exercises vs full simulations

	Tabletop exercise	Full [crisis simulation](/glossary/cyber-crisis-simulation-exercises/)
Format	Discussion-based	Operational – may include live technical elements
Systems tested	None	May test SOC procedures, comms tools, failover
Participants	Board, executives, senior management	All levels including technical responders
Duration	2-4 hours	Half day to multiple days
Complexity	Lower – accessible to non-technical participants	Higher – requires technical coordination
Cost	Lower	Higher
Best for	Board engagement, plan validation, regulatory evidence	End-to-end response testing, SOC readiness

Both formats are valuable. Tabletop exercises are typically a starting point. Organisations with mature incident response capabilities progress to full crisis simulations that test technical execution alongside strategic decision-making.

Why tabletop exercises matter for boards

The UK Corporate Governance Code and NCSC board toolkit both emphasise that cyber security is a board-level responsibility. Tabletop exercises are one of the most effective ways to engage board members with cyber risk because they require no technical knowledge. Directors participate as decision-makers – the same role they would play in a real incident.

Regulators increasingly expect evidence of exercising. Organisations subject to NIS2 requirements must demonstrate incident response preparedness. Financial services firms operating under DORA must conduct regular scenario testing. A tabletop exercise provides documented evidence that the board has tested its response.

Cyberfort and tabletop exercises

We design and facilitate tabletop exercises for boards, executive teams, and incident response teams. Scenarios are built from real threat intelligence relevant to your sector and tailored to your organisation’s systems, suppliers, and regulatory obligations. Our facilitation team includes experienced incident responders who know what breaks under pressure because they have handled real breaches through our incident response service.

Related glossary terms

• Cyber Crisis Simulation – full operational simulation that extends beyond discussion into live response testing
• DFIR – the digital forensics and incident response capability that tabletop exercises are designed to test
• Red Teaming – adversarial simulation that tests defences through live attacks, unlike the discussion-based tabletop format
• NIS2 Directive – EU directive requiring incident response preparedness, for which tabletop exercises provide evidence
• DORA – financial services regulation mandating scenario-based resilience testing

External references

• Wikipedia: Tabletop exercise – overview of the exercise format
• Wikidata: Q113538695 – canonical entity identifier
• NCSC: Exercise in a Box – free tabletop exercise scenarios from the UK National Cyber Security Centre
• NIST SP 800-84: Guide to Test, Training, and Exercise Programs – NIST framework covering tabletop exercise design and execution

Frequently asked questions