Who pulls the plug?
A 60-minute cyber incident rehearsal any manager can run. Cold, first time, no experience needed.
What a tabletop exercise actually is.
Your team, round a table, talking through a cyber incident as it unfolds.
Somebody reads out what has just landed. Everyone argues about what to do. Then the next thing lands, whether you’ve finished arguing or not.
No computers. No tech skills. No right answers. No consultant. And no permission needed from anyone.
What you get out of it is an hour of finding out that three people in the room each assumed somebody else was calling the insurer. In a meeting room, with coffee, where it costs you nothing.
You don’t rise to the occasion in a real incident. You fall to the level of your preparation.
Friday’s invoice.
On Friday afternoon, someone in finance opened an “outstanding invoice” attachment. Nothing happened. Until Monday.
Three odd helpdesk tickets in ten minutes. Finance can’t open files on the shared drive.
A README_DECRYPT.txt has appeared in every affected folder.
The ransom note: 4.2 Bitcoin within 72 hours, or the stolen data gets published.
A local journalist emails: “We’re hearing you’re having an outage. Any comment?”
Eleven injects in all, written to be read aloud, argued over and debriefed within 60 minutes. The scenario is deliberately generic so any team can map it onto its own systems and people. Swap in real names as you go: what is our version of the shared drive? Who is our version of that finance colleague?
What’s in the pack.
Facilitator guide
How to run a tabletop if you’ve never done one: setting up, the two roles, the ground rules and a run sheet that keeps you on the clock.
Inject cards
One development per card, read aloud in order, each with two questions to start the argument.
Decision log
The scribe’s sheet. What was decided, who decided it, and where the room got stuck. It turns “that was interesting” into a list of things you’re fixing.
Debrief sheet
Six questions about how your organisation would handle a crisis. Not the technical side: the business side.
What you need to run it.
- Four to ten peopleNot just IT. They’ll be great on the technical bits and stuck on everything else. You want whoever would decide about paying a ransom, someone from communications for when a journalist calls, someone from operations who knows what stops when systems go down, and someone senior enough to spend money without ringing anyone first.
- A room, an hour and a printerNo screens, no projector, nothing to install. Phones face down.
- Two volunteersOne reads the cards and watches the clock. The other writes down what gets decided. That second job matters most.
- No preparation for anyone elseDon’t share the scenario beforehand, or you’ll get answers people have had time to think up. Read the guide the day before if it helps, but you can open it cold on the day and be fine.
Get the pack.
Four files: the inject pack, the facilitator guide, the decision log and the debrief sheet. Tell us who you are and they’re yours.
Print them, book a room, and run it with your team this month.
How we use your details: privacy notice.
Print these and you’re ready.
Ready to upgrade your tabletop?
You’ve just found the gaps in a made-up incident, at your own pace, over coffee. That’s useful. But you held the clock. You decided when the next thing happened. Nobody’s phone actually rang, and you had time to agree your media statement before you committed to it.
With CMD, that changes. AI calls land on your leadership team’s real phones, the story branches on their decisions, and the pressure isn’t imagined. It’s the difference between reading the map and driving the road.
The things people ask.
What is a tabletop exercise?
A discussion-based rehearsal. A facilitator walks a group through an incident in stages, the group talks through what they would do at each stage, and nobody touches a system. It is built around decisions, authority and communication rather than technical response, which is what separates it from a technical simulation or a red team test. Nothing is attacked. The point is finding out who decides what.
How long does a tabletop exercise take?
Anything from an hour to a couple of days. One scenario with one team runs in one to two hours; this pack is built for 60 minutes. A full crisis rehearsal with several teams takes half a day or more. What drives the length isn’t the scenario, it’s how many teams you involve and how many decisions you want to force.
Who should take part?
The people who would be needed for the real thing: someone who can make expensive decisions, IT and security, whoever handles communications, legal or your data protection lead if personal data could be involved, and operations. Four to ten people works for this pack. Everyone needs room to speak, and a bigger group turns into a presentation rather than a discussion.
Do I need any experience to run it?
No. The facilitator guide covers everything, and you can open it cold on the day. Your main job is to read each card, ask the questions and then stay quiet while the room works it out.
Is it really free?
Yes. Tell us who you are and the four files are yours to download, print and run as often as you like inside your organisation.