Tabletop exercises

Cybersecurity tabletop exercises built for your environment

A tabletop exercise lets your team rehearse a cyber incident before it happens. We build a realistic scenario around your systems and concerns, guide your technical and executive teams through it and show you exactly where your response plan needs work.

Plan your exercise What is a tabletop exercise
  • Scenarios written for your environment
  • Technical and executive exercises
  • Readout and improvement plan for leadership
Two colleagues working through a scenario at a computer

What is a tabletop exercise

What is a tabletop exercise?

A tabletop exercise, often called a TTX, is a discussion-based session in which a team walks through a simulated emergency and talks through how it would respond. There is no live attack and no systems are touched. A facilitator presents a scenario in stages, and participants explain the decisions they would make, who they would call and what information they would need.

In cybersecurity, tabletop exercises test an incident response plan against a realistic event such as ransomware, a compromised email account or a data breach. The value comes from finding gaps in a low-stakes setting. Teams discover unclear roles, missing contacts, untested backups or decisions nobody has authority to make, and fix them before a real incident.

What a cybersecurity tabletop exercise tests

  • Whether people know their roles and who makes each decision
  • Whether the incident response plan works as written
  • How IT, leadership, legal and communications work together
  • How escalation, notification and insurance steps would actually happen

Public sector experience

IR tabletop exercises for California cities through CJPIA

Plan review first

We read your IR documentation before writing the scenario

Two audiences

Technical teams and executive leadership

Scenarios

Tabletop exercise scenarios we run

Every scenario is written for your environment and your concerns. These are the most common starting points.

Ransomware tabletop exercise

Encrypted systems, a ransom demand and pressure from leadership, insurers and customers. Tests containment, recovery order and decision authority.

Business email compromise

A compromised executive mailbox and a fraudulent payment request. Tests detection, finance controls and communications.

Data breach

Sensitive or regulated data taken from your environment. Tests investigation, legal review and notification decisions.

IT disaster recovery tabletop exercise

Loss of a data center, cloud region or critical application. Tests backups, recovery sites and business continuity plans.

Third-party incident

A breach at a vendor or service provider that affects your systems or data. Tests vendor contacts and contract obligations.

AI tabletop exercise

Data leaking through an AI tool, a compromised AI vendor or an AI agent acting outside its authority. Tests AI ownership and response.

AI security

How it works

How an incident response tabletop exercise runs

1

Review your documentation

We assess your incident response plan and related procedures, and meet with your team to understand your environment and concerns.

2

Build the scenario

We write a scenario specific to your systems and risks, with injects that test the parts of your plan most likely to fail.

3

Workshop and exercise

We open with an educational workshop on incident response, then moderate the technical and/or executive exercise.

4

Evaluate and report

We evaluate your response capability and deliver a summary or presentation for leadership with prioritized improvements.

Technical and executive

Exercises for the people who respond and the people who decide

Technical exercises go deep on detection, containment, forensics and recovery with IT and security staff. Executive exercises focus on decisions leadership has to make, such as whether to shut down operations, when to notify customers or regulators and how to work with insurers and counsel.

Many organizations run both, or run a combined session that challenges security teams to explain the situation to executives and the board. That handoff is often where real incidents slow down.

  • Technical exercise for IT and security teams
  • Executive exercise for leadership and the board
  • Combined sessions that test the handoff between them
Colleagues meeting in an office

What you get

Deliverables from every tabletop exercise

  • Review of your incident response documentation
  • Scenario built for your environment and concerns
  • Educational workshop for participants
  • Facilitated technical and/or executive exercise
  • Evaluation of your incident response capability
  • Summary or presentation for leadership
  • Prioritized recommendations for your IR plan
  • Clarified roles and responsibilities

What clients say

Working at the pace of public agencies

“Triden Group’s level of patience is noteworthy, especially when working with a public agency. We tend to move toward purchases much slower due to strict purchasing procedures. Triden Group feels like a true partner in achieving our security goals.”

IT Director, water district

FAQ

Tabletop exercise questions

It is a facilitated, discussion-based session in which your team talks through how it would respond to a simulated cyber incident, such as ransomware or a data breach. No systems are touched. The goal is to find gaps in roles, plans and decisions before a real incident.

For a technical exercise, IT and security staff plus anyone who manages critical systems. For an executive exercise, leadership, legal or compliance, communications, finance and operations. Many organizations include their outside IT provider or insurer contact as well.

At least once a year, and after major changes such as a new incident response plan, a merger, new leadership or a significant incident. Many frameworks and cyber insurers expect the incident response plan to be tested regularly, and a tabletop is the most common way to do it.

Cost depends on the number of scenarios, whether you run technical, executive or both sessions, how much custom research the scenario needs and whether we also review and update your incident response plan. We scope it on a call and send a fixed quote.

Yes. AI scenarios cover data leaking through AI tools, a compromised AI vendor or plugin and AI agents acting outside their authority. They help you decide who owns AI systems during an incident. See our AI security services for related work.

It helps, but it is not required. If you do not have a plan, the exercise will show what it needs to cover. Our incident response plan template is a useful starting point.

Related services

Related services

Incident response

Our full incident response and DFIR practice.

Incident response

IR and recovery retainers

Responders and recovery engineers arranged in advance.

Retainers

Social engineering

Test how staff respond to phishing and pretexting.

Social engineering

Government and public agencies

Assessments and exercises for cities and public agencies.

Government

Plan your exercise

Rehearse your response before you need it

Tell us which scenarios concern you most and who should take part. We’ll propose an exercise and send a fixed quote.

  • Scenario built for your environment
  • Readout for leadership with clear next steps

Prefer email? Write to [email protected] or call (858) 712-0040.

Send us a message