What Is a Tabletop Exercise?

What Is a Tabletop Exercise?

A tabletop exercise (TTX) is a structured, scenario-based discussion in which your incident response team walks through a simulated cyberattack or security incident. No systems are affected — participants sit around a table (or a conference call) and talk through how they would respond to each stage of a developing scenario. A facilitator presents injects — new developments in the scenario — that force the team to make decisions and reveal gaps in their response plan.

What a Typical Ransomware Tabletop Looks Like

A ransomware tabletop typically runs two to four hours and follows a scenario arc. The facilitator presents the initial discovery — an employee reports that files are encrypted and ransom notes are appearing on screens. From there, injects escalate the situation: the backup servers are also encrypted, a regulatory notification deadline is approaching, a journalist is calling asking for comment, the CEO wants to know whether to pay the ransom. The team works through each decision using their documented plan — revealing which parts of the plan are clear and which require clarification.

Who Should Participate

Tabletop exercises are most valuable when they include representatives from IT, security, legal, communications, finance, and executive leadership. The most common gap organizations discover is that the technical response team has a solid plan, but legal counsel, communications, and the CFO have never discussed their roles in the scenario. The exercise brings these groups together before an incident forces the conversation under pressure.

What Tabletops Reveal

Organizations consistently discover several categories of gaps in their first tabletop exercise: decision authority is unclear for key choices like ransom payment; contact information is not stored offline where it can be accessed during an incident; notification timelines are not understood; and communication templates for customers, employees, and regulators do not exist. Finding these gaps in a tabletop costs hours. Finding them during an incident costs millions.