Facilitating a Tabletop Exercise: Technique, Pressure and Silence

Open by removing the fear

Say explicitly that the exercise is no-fault, that nothing is being reported to HR, and that the goal is to find gaps in the process. Then say the uncomfortable part: "if this session is comfortable, I have failed."

Managing the dominant executive

• Direct injects to a named seat, not to the room.
• Ask the quietest relevant seat first, then open it up.
• Use private information: give a junior seat a fact the CEO does not have.

Pressure techniques that work

• The two-minute on-the-record decision.
• The contradicting artefact: a log that disproves what someone just asserted.
• The external clock: a journalist publishing in an hour.
• The consequence inject: something the room said out loud appearing on a leak site.

When to break the script

If the room goes somewhere unexpected and interesting, follow it. A pre-written inject that no longer fits the conversation drains energy instantly. Improvising an inject that reacts to what was actually said is the single biggest difference between a facilitator people request again and one they tolerate.

Closing the room

Stop on time. Run the hot wash while people are still seated. Ask each seat for one thing they will change, and write it down in front of them.

Frequently asked questions

What if the room solves the scenario too quickly?

They have not — they have made an assumption. Introduce the inject that makes it false: the backup that does not restore, the vendor that will not confirm, the customer who already knows.

Should the CISO facilitate their own exercise?

Ideally not. The CISO usually owns decisions the exercise should test, so facilitating removes the most interesting seat from the room.