How to Run a Tabletop Exercise

A tabletop exercise is a discussion-based rehearsal of a security incident. Running one helps teams find gaps in their plans without the pressure of a real crisis.

What a tabletop exercise is

Participants walk through a realistic scenario, such as ransomware or a data leak, and discuss who does what at each stage. No systems are touched; the goal is to test decisions and communication.

Plan the exercise

Define objectives, pick a scenario relevant to your business, and invite the right people from IT, management, legal, HR, and communications. Prepare injects, which are new pieces of information introduced during the session.

Run the session

Appoint a facilitator, present the scenario in stages, and ask open questions about decisions, authority, and tools. Take notes on confusion and disagreements.

Capture lessons

Afterward, list gaps in the plan, unclear roles, and missing contacts. Rank improvements and assign owners with deadlines.

Repeat regularly

Hold exercises at least once a year and after major changes. Vary scenarios to test different parts of your response.

Key takeaways

• What a tabletop exercise is: Participants walk through a realistic scenario, such as ransomware or a data leak, and discuss who does what at each stage. No systems are touched; the goal is to test decisions and communication.
• Plan the exercise: Define objectives, pick a scenario relevant to your business, and invite the right people from IT, management, legal, HR, and communications. Prepare injects, which are new pieces of information introduced during the session.
• Run the session: Appoint a facilitator, present the scenario in stages, and ask open questions about decisions, authority, and tools. Take notes on confusion and disagreements.
• Capture lessons: Afterward, list gaps in the plan, unclear roles, and missing contacts. Rank improvements and assign owners with deadlines.
• Repeat regularly: Hold exercises at least once a year and after major changes. Vary scenarios to test different parts of your response.

Putting it into practice

To apply this in your own organization, begin with a short assessment of where you stand on tabletop exercise today. Write down who owns it, which tools are involved, and the single biggest gap. Fix the highest-risk gap first, assign a clear date, and review progress after thirty days. Share what you learn with the team so improvements stick, and document the decisions you make so new staff can follow them. Revisit the topic every quarter, because threats, tools, and business needs change quickly, and small regular adjustments are far easier than large emergency fixes.

Common mistakes to avoid

Many teams struggle with tabletop exercise because they try to do everything at once, skip documentation, or treat it as a one-time project. Others rely on a single person who holds all the knowledge, or buy tools before defining the problem they need to solve. Avoid these traps by starting small, writing down simple procedures, spreading responsibility across the team, and checking results on a regular schedule. If something is not working, adjust quickly instead of abandoning the effort, and keep a short log of what you changed and why. That record makes future decisions faster and helps new colleagues understand the reasoning behind your approach.

Frequently asked questions

How long does it take?

Usually two to three hours.

Who should attend?

Decision makers and technical responders.

Final thoughts

Practice makes real incidents manageable. Run a tabletop, fix the gaps, and repeat.