Not a slide deck. An incident built for you.
Most tabletops are a standard set of slides any company could run through. Ours start with your organization: who you are, what you have, and what matters most to you. We suggest the scenarios that fit, build the exercise around your environment, and run it with people who have led real incidents, not just read about them.
- Scenario
- Built for your organization
- Facilitated by
- Principals, decades of experience
- In the room
- Leaders, technical teams, legal
- You leave with
- Gaps ranked, next steps clear
What makes it different
Run by people who have been through the real thing.
Many tabletops are run by junior facilitators who have never been through an incident. Brian and Dan bring decades of experience across networking, systems, software, endpoints, mobile and cloud. They have worked real incidents end to end: real ransoms, law enforcement, regulators, boards, CEOs, executives and legal counsel. That is what makes the exercise feel real and the lessons stick.
Built for you
Your scenario, not a template.
We start with questions about who you are, what you have and what matters to you. Then we suggest the scenarios that fit and build the exercise around your systems, people and data.
Lived experience
Facilitators who have done it.
Ransom demands, law enforcement, regulators and boards. We bring what actually happens in an incident, including the parts no template covers.
Whole picture
Technical depth and boardroom judgment.
Networks, systems, endpoints and cloud on one side. Executives, legal and regulators on the other. We can challenge both sides of the room.
The problem
Why most tabletops don't prepare anyone.
The exercise happens, the box gets checked, and the organization is no more ready than it was before.
- Generic scenariosA standard deck any company could run, so nothing feels real.
- Junior facilitatorsPeople who have never been through an incident, so the hard questions never come up.
- Half the roomTechnical teams or leadership, rarely both working the same problem.
- No real pressureNo ransom note, no regulator, no board on the phone. The decisions that matter never get tested.
- Findings that go nowhereA list of observations with no priority and no owner.
How it works
Understand, build, run it like it's real.
A little of your time up front, one exercise built for you, and clear outputs.
- 01
Initial questions
Who you are, what you have, what matters most to you, and what worries leadership.
- Critical systems and data
- Key people and decision makers
- Regulators, contracts and insurance
- 02
Suggested scenarios
We propose the incidents that best fit your organization, and you choose the one to run.
- Ransomware and extortion
- Business email compromise and payment fraud
- Data breach with regulatory notice
- Cloud or third-party outage
- 03
Build the exercise
Injects, timelines and decision points written for your environment, your people and your plan.
- 04
Run the exercise
We facilitate with your leadership, technical teams and legal, and bring the pressure a real incident brings.
- Ransom demands and negotiation
- Law enforcement and regulators
- Board, executive and customer communication
- 05
Debrief
Right after the exercise: what worked, what broke, and what surprised people.
- 06
Findings and next steps
Gaps scored with your risk methodology and ranked, so the fixes get funded and done.
Who it's for
Ready to decide. Ready to respond.
For leadership and the board
Know your role before it counts.
- Decision rightsWho decides on ransom, disclosure and shutdown.
- CommunicationWhat to tell staff, customers, regulators and the press.
- Realistic expectationsHow long recovery takes and what it costs.
For technical teams
Practice with people who have done it.
- Real-world detailContainment, evidence and recovery as they actually play out.
- Clear handoffsWhen to escalate and who to call.
- Gaps found safelyLogging, backup and access problems found before an attacker finds them.
What you get
IR Tabletop Exercises deliverables.
Concrete artifacts you keep, not a slide deck that disappears after the readout.
- 01
Scenario options
Incidents suggested for your organization, with the reasoning.
- 02
Custom exercise
Built for your environment, people and plan.
- 03
Facilitated session
Run by principals who have led real incidents.
- 04
Debrief
Immediate lessons, while they are fresh.
- 05
Findings report
Gaps scored with your risk methodology and ranked.
- 06
Plan updates
Specific changes to your incident response plan and contact lists.
Runs on one risk language
Scored with your methodology.
Every finding is scored the same way as the rest of your program. Already have a methodology? We use it. If not, we build it with you first, in a single workshop.
How we build a risk methodology →“The first time your team hears a ransom demand should not be the real one.”CyberRisk One
Connected services