Consultant-led tabletop or crisis simulation platform: what changes when software runs the exercise

What does a consultant-led tabletop look like?

Incident response firms sell tabletop exercises as a service. CrowdStrike describes its Tabletop Exercise as discussion-based. Palo Alto Networks sells Unit 42 incident simulation and testing services. The typical engagement runs over several weeks: interviews with stakeholders, a scenario written around the organisation, one facilitated session, and a report afterwards. Reflex Security's homepage frames the traditional tabletop as taking 2–4 weeks to prepare; that is a vendor's framing of its competition, but it matches the shape of the work.

We do not score these services. They are not platforms, and their quality depends on the individual facilitator more than on anything we could read on a web page.

What does a platform change?

Three things change when software takes over parts of the job.

• Preparation. Platforms generate or assemble the scenario. TryHackMe states a 10-minute average launch; Reflex describes building a scenario in minutes from the organisation's footprint; Conducttr's LISA assistant drafts the master events list.
• Facilitation. Some platforms run the session: Reflex describes an AI facilitator inside the video call, and Hack The Box describes Crisis Control as platform-led with facilitator guidance. Others, such as Conducttr, give your own facilitator better tools.
• The record. Platforms capture decisions and timings as they happen and produce the report, rather than relying on a note-taker.

The combined effect is frequency. If an exercise takes an afternoon instead of a month, it can be run every quarter, on different scenarios, with different subsets of the team.

What does a consultant still do better?

An experienced outside facilitator has seen how other organisations failed. They will notice when a chief executive's confident answer rests on an assumption nobody has checked, and they can say so with an authority an internal facilitator lacks. For a first exercise with a board that has never done one, or after a real incident, that judgement is hard to replace with software.

A consultant can also shape the exercise around political realities inside the organisation: which executive needs to be challenged gently, which relationship between legal and communications is strained. Software does not know those things unless someone tells it.

What about independence?

An outside facilitator has no stake in the result. That matters when the audience is a board or a regulator. A platform run by the security team can still produce a credible record, but the people reviewing it will ask who designed the scenario and who judged the result. Keep the design and scoring rules written down, and invite an outside reviewer from time to time.

What does each cost?

We cannot compare from published prices. Consultant tabletop fees are not on the service pages we read. Among platforms, only Conducttr publishes complete licence prices, from £11,950 to £25,725 a year. TryHackMe claims its tabletops are "56% more affordable than the average consultancy tabletop exercise", and Reflex Security says that "for the cost of a single consultant-led exercise, Reflex gives you the whole platform". Both are vendor claims and neither shows a price. Ask every provider for a price per exercise and per year at the cadence you intend.

Where do free packages fit?

CISA publishes over 100 Tabletop Exercise Packages with scenarios, discussion questions and an After Action Report template. They are the baseline either option should improve on, and a sensible way to run a first internal exercise before paying anyone.

How do you switch without losing what you had?

If you move from a consultant to a platform, keep the parts of the old process that worked. Reuse the objectives and the after-action findings from the last facilitated exercise as the first inputs to the platform, so the new programme starts by testing old gaps. Keep the same measures, such as time to convene and time to key decisions, so you can show whether the change helped. And keep one internal owner who knows the history.

A combined model

1. Once a year: an outside-facilitated exercise for the board and executive team, on the scenario that would hurt most.
2. Each quarter: platform-run simulations for the crisis team and technical leads, on rotating scenarios.
3. In between: short drills on thresholds, contacts and escalation.
4. Every time: the same measures, so improvement can be shown.

The point is not to choose a side. It is to stop the annual exercise being the only one.