Who pulls the plug?
A 60-minute cyber incident rehearsal any manager can run. Cold, first time, no experience needed.
60 mins • 11 cards • 10 people • Free
Start here
What a tabletop exercise actually is
Your team, round a table, talking through a cyber incident as it unfolds. Somebody reads out what has just landed. Everyone argues about what to do,. Then the next thing lands, whether you've finished arguing or not.
No computers. No tech skills. No right answers. No consultant. And no permission needed from anyone.
What you get out of it is an hour of discovering that three people in the room each assumed somebody else was calling the insurer. In a meeting room. With coffee. Where it costs you nothing.
You don't rise to the occasion in a real incident. You fall to the level of your preparation.
The Scenario
Friday's Invoice
On Friday, someone in finance opened an "outstanding invoice" attachment. Nothing happened. Until Monday.
08:42
Three odd helpdesk tickets.
09:05
A README_DECRYPT.txt sitting in every folder.
09:30
Ransom note demanding 4.2 BTC within 72 hours.
10:15
Local press on the line wanting a comment for the paper.
Eleven injects in total, designed to be read aloud, discussed and debriefed within 60 minutes.
The scenario is deliberately generic, so any team can map it onto their own systems and their own people. You swap in real name as you go. What's our equivalent of the shared drive? Who is our version of that finance colleague?
Four Pieces
What's in the pack
Facilitator Guide
How to run a tabletop if you've never done it before. Includes set up instructions, required roles, ground rules, and guidance.
Inject Cards
One situation per card, read aloud in sequence, each with a decision prompt to guide the conversation.
Decision Log
The scribe's sheet. What was decided, who decided it, and where the room got stuck. This is what turns "that was interesting" into a list of things you're fixing.
Debrief Sheet
Six questions to get you thinking about how well your organisation would handle a crisis. Not from a technical standpoint, but from a business perspective.
Before you book the room
What you need to
run it
Between four and ten people. Don't fill the room with IT. They'll be great on the technical bits and stuck on everything else. You want whoever would have to decide about paying a ransom. Somebody from comms because a journalist turns up. Somebody from ops who knows what actually stops when systems go down. And someone senior enough to spend money without ringing anyone first.
Then a room, an hour and a printer. No screens, no projector, no wifi, nothing to install. Phones stay face down.
Two volunteers out of that group. One to read the cards and watch the clock. The other to write down what gets decided. That's the important bit.
No prep for anybody. Don't tell anyone the scenario beforehand or you'll get answers they've had time to come up with. Read the guide the day before if it makes you feel better, but you can open it cold on the day and be fine.
Free download
Give me the
goodies.
When paper isn't enough
Ready to upgrade your tabletop exercise?
You just found the gaps in a made-up incident, at your own pace, over a nice coffee. And that is useful.
But you held the clock. You decided when the next thing happened. Nobody's phone actually rang. And you had time to discuss your media statement before committing to it.
With CMD, all that changes. AI phone calls land on your leadership team's real phones, decisions branch in real time, and the pressure isn't imagines. It's the difference between reading the map and driving the road.
When you want to see how your people really hold up, rather than how they say they would, talk to us. We're ready when you are.
FAQS