How to Run Your First Cybersecurity Tabletop Exercise in TableTop Sim

To run a cybersecurity tabletop exercise in TableTop Sim, define one decision boundary, select and tailor a scenario, assign participant roles, and deliver staged injects from the facilitator control room. Finish with an immediate hot wash and issue the web and PDF after-action report on the day of the exercise.

What is a cybersecurity tabletop exercise?

A cybersecurity tabletop exercise is a facilitated discussion in which participants respond to a developing fictional incident. It tests decisions, communication, responsibilities, assumptions and dependencies without disrupting production systems.

TableTop Sim provides a mission-control console for the facilitator and role-specific incident bridges for participants. Participants join with a code, so they do not need accounts or installs.

A typical exercise lasts 60-120 minutes. The objective is not to complete every possible incident-response task; it is to observe how the team makes decisions under pressure and identify practical improvements.

1. Define one decision boundary

Start by deciding what the exercise must examine. A narrow scope gives the facilitator a clear basis for choosing injects, applying pressure and stopping discussions that drift into unrelated issues.

Useful decision boundaries include:

• Whether and when to activate the incident-response plan
• How the organisation handles a material service disruption
• Who can authorise an external communication
• How executives decide between containment and operational continuity
• When legal counsel, insurers, suppliers or other external parties enter the process

Write the objective as an observable question. For example: Can the team establish incident leadership, assess operational impact and approve initial communications with incomplete information?

Do not frame the objective as proving that a plan works. The exercise should expose uncertainty and generate evidence for improving the plan.

2. Select and tailor the scenario

Choose a scenario that creates the decisions inside your defined boundary. TableTop Sim includes 12+ ready scenarios, which you can review through the scenario library.

Before the session, tailor the exercise to the organisation’s environment. Relevant details can include:

• Technology stack and critical services
• Workforce model
• Sector context
• Executive and technical roles
• Key suppliers or operational dependencies
• Existing incident-response terminology

TableTop Sim supports AI environment tailoring, which rewrites injects to match the client stack, workforce model and sector. Review every tailored inject before the session to confirm that it is understandable, internally consistent and relevant to the exercise objective.

Avoid adding detail merely to make the scenario complicated. Every organisation-specific fact should either support realism, create a decision or test an assumption.

3. Build the exercise timeline

Arrange injects as a sequence of changing conditions rather than a list of questions. Each inject should reveal new information, complicate a previous decision or require a different role to act.

A simple first-exercise structure is:

• Opening: Establish the initial alert, uncertainty and immediate business context.
• Escalation: Introduce service impact, conflicting evidence or a widening scope.
• Decision point: Require the team to choose an owner, action or communication path.
• External pressure: Add a stakeholder, supplier, media or customer dimension where relevant.
• Closing state: Reveal enough information to review the consequences of the team’s decisions.

TableTop Sim’s control room gives the facilitator an inject timeline, countdown control, response feed, private notes and pause controls. Plan approximate timings, but be prepared to adjust based on the room.

For broader preparation advice, use the facilitator guides alongside the exercise timeline.

4. Assign seats and brief the room

Invite the people who would make or inform the decisions being tested. TableTop Sim offers role-based participant views for roles including CEO, CISO, General Counsel, Communications Director, IT lead and observers.

Assign one person to each key responsibility where possible. If someone holds several responsibilities in normal operations, state which role they are representing during the exercise.

At the start, explain:

• The objective and decision boundary
• The fictional starting conditions
• The expected duration
• How participants receive and respond to injects
• Which assumptions are permitted
• That the exercise tests the system, not individual performance
• When the facilitator may pause or move the discussion forward

Participants enter with a code and land in their role-specific incident bridge. Allow time for everyone to join and understand the interface before starting the live clock.

5. Facilitate decisions, not presentations

When the exercise begins, release the opening inject and let participants interpret it. Resist the urge to explain the intended meaning or provide information they have not requested.

Use direct prompts when discussion stalls:

• Who owns this decision?
• What information do you need before acting?
• How long are you prepared to wait?
• Who must be informed now?
• What is the operational consequence of that choice?
• Where is that authority documented?

Apply pressure by changing conditions, shortening the available time or exposing a dependency. Do not apply pressure by arguing with participants or trying to catch them out.

Use the response feed to monitor what participants submit and private notes to capture observations that should appear in the review. If confusion becomes unproductive, pause the exercise, clarify the rules or known facts, and restart the clock.

TableTop Sim can also produce AI-improvised injects that follow the room. Use them when an unexpected participant decision creates a useful branch, but keep each addition tied to the original objective.

6. Capture evidence as the exercise unfolds

Record specific decisions and their consequences rather than general impressions. Useful evidence includes:

• Who assumed incident leadership and when
• Which escalation thresholds participants used
• Where ownership was unclear
• What information changed a decision
• Which dependencies delayed action
• Which communications were approved, rejected or deferred
• Where participants relied on undocumented assumptions

Distinguish between a missing capability and a capability that participants did not know existed. Those findings may require different corrective actions.

Also record effective practices. An after-action report should preserve decisions and methods worth repeating, not only list gaps.

7. Hold the hot wash immediately

End the scenario at a deliberate point instead of continuing until every issue is resolved. Reserve time for a hot wash while the decisions and disagreements are still fresh.

Ask each role:

• What worked?
• What was unclear?
• Which decision was hardest?
• What information arrived too late?
• What should change before the next exercise?

Compare participant feedback with the facilitator’s notes. If people disagree about what happened, capture the disagreement as evidence of unclear authority, terminology or process rather than forcing immediate consensus.

8. Issue and track the after-action report

TableTop Sim generates a web and branded PDF after-action report on the day of the exercise. The report should translate the session into manageable follow-up work.

Include:

• Decisions made during the scenario
• Lessons learned
• Recommended alternatives
• Named action owners
• Due dates

Recommendations should be specific enough to verify. Replace improve communications with an action such as defining who approves the first external statement, documenting an alternate approver and exercising that path again.

A tabletop exercise can support readiness and provide evidence for wider governance activity, but TableTop Sim does not deliver regulatory compliance on its own. Treat the report as an input to your organisation’s risk, assurance and improvement processes.

Common mistakes in a first exercise

Testing too much

A broad scenario produces shallow discussion. Keep one decision boundary and defer unrelated issues to future exercises.

Reading injects like slides

Injects should change the situation and trigger action. Let the room work through uncertainty rather than explaining each development.

Letting technical discussion consume the session

Technical analysis matters, but executives, legal counsel and communications leaders also need space to make decisions. Redirect deep troubleshooting when it no longer serves the objective.

Ending without ownership

A list of lessons is not an improvement plan. Give each agreed action an owner and due date in the after-action report.

For an end-to-end overview, see how to run a cybersecurity tabletop exercise.

Frequently asked questions

How long should the first exercise take?

TableTop Sim exercises typically run for 60-120 minutes. Choose a duration that leaves time for the briefing, staged injects and an immediate hot wash.

Do participants need TableTop Sim accounts?

No. Participants join with a code, require no account or install, and enter a role-specific incident bridge.

Should we tell participants the scenario in advance?

Brief participants on the objective, scope, format and their roles. You can withhold the incident developments so the team must assess changing information during the session.

Can the facilitator change the exercise while it is running?

Yes. The facilitator can control the timeline and countdown, monitor responses, keep private notes and pause the session. AI-improvised injects can follow the room when a participant decision creates a relevant path.

What should happen after the exercise?

Hold a hot wash immediately, then issue the web and PDF after-action report on the day. Track decisions, lessons, recommended alternatives, owners and due dates, and use them to shape the next exercise.

Run your first exercise

Use TableTop Sim to select a scenario, manage live injects and turn the session into an after-action report. Start the free trial and prepare your first cybersecurity tabletop exercise.