Free tabletop baselines: CISA's packages, the KnowBe4 kit, and when a paid platform is worth it

What does CISA provide?

CISA publishes over 100 Tabletop Exercise Packages. Each includes objectives, a scenario, discussion questions and references, plus a slide deck, a feedback form and an After Action Report template. Cyber scenarios cover ransomware, insider threats, phishing and industrial control system compromise, and there are versions for particular sectors. They are free and written for discussion-based exercises.

What does the KnowBe4 kit add?

KnowBe4 announced a free Cybersecurity Awareness Month resource kit on 11 August 2026 for October. It includes posters and signage in several languages, four tabletop exercise documents, training videos and modules, planning resources and webinars, organised around four weekly themes. The kit is aimed at awareness programmes for the whole workforce; its tabletop documents are a starting point for a small exercise during the month. KnowBe4 sells security awareness training, a different category from the platforms we score. Its published US list prices (MSRP, May 2026, three-year term) start at $2.40 per seat per month for SAT Foundation and $3.75 for SAT Advanced at 25–50 seats, falling with volume; above 1,000 seats it quotes.

How do you get the most from a free package?

1. Pick the scenario closest to your highest-impact risk, not the most dramatic.
2. Rewrite the names: replace generic systems and suppliers with your own. This is the cheapest realism improvement available.
3. Write three to five scoreable objectives before the session (lesson 4).
4. Add time pressure: give each discussion stage a deadline and make the scenario move on when it passes.
5. Add outside pressure: a journalist's call or a social media post, written by you.
6. Use the After Action Report template within a few days, and give each finding an owner and a date.

What can free packages not do?

They do not react. The scenario moves in the order it was written, whatever the group decides. They do not run themselves: someone has to facilitate, keep time and take notes. They do not produce evidence: the report is only as good as the note-taker. And they are generic until you edit them.

None of this makes them a poor choice. NIST SP 800-84 describes discussion-based tabletops as a legitimate part of an exercise programme. The question is whether the gaps matter for your situation.

When is a paid platform worth it?

• When you need to exercise more than once or twice a year, and preparation time is the barrier.
• When your executives keep missing exercises, and you need stand-ins, asynchronous play or shorter formats.
• When the scenario needs to react to decisions to be credible to a sceptical audience.
• When a regulator, auditor or board expects measured evidence mapped to frameworks.
• When you want the information environment simulated rather than read out.

Each of these maps to a criterion in our scoring. A team with none of these needs may be well served by CISA's packages and a good internal facilitator.

What does a paid platform cost compared with free?

Mostly unknown from public pages. Conducttr is the only scored platform with a complete public price list, from £11,950 a year. The others sell through demos. Reflex Security frames its offer as unlimited exercises against one a year; iluminr frames short microsimulations as continuous testing. Ask each vendor for a price at the cadence you intend, then compare that with the internal time a free package takes to adapt, facilitate and write up.

What do free packages teach you about buying?

Running one free exercise first makes you a better buyer. You learn how long preparation really takes, which executives attend, what the report needs to contain and which gaps were caused by the format. That gives you concrete questions for vendors: can your platform cut our preparation from two weeks to a day, run the session if our facilitator is unavailable, and produce the report we wrote by hand? Answers to those questions are worth more than a demo of features.

A sensible progression

1. Run one CISA package internally, adapted to your names and systems.
2. Read the after-action report honestly: which gaps came from the format rather than the plan?
3. If the format gaps matter, shortlist two or three platforms using the planner with weights that reflect those gaps.
4. Keep using free packages for discussion sessions alongside any paid platform.

Whichever route you take, the measure of success is the same: fewer surprises in the next real incident, and findings that get closed between exercises rather than rediscovered.