TABLETOP SCHOOL
Tabletop school: ten lessons on cyber crisis exercises that change behaviour
THE SHORT ANSWER
Ten short lessons in three tracks: what a crisis exercise is and what makes it realistic, how to design and run one with the people who matter, and how to turn the result into evidence and fixes. Each lesson takes two to three minutes to read and links to the platforms that do each step.
By The Exercise Desk · Crisis Simulation Ranked · Published 2026-10-11
Foundations
What a crisis exercise is, what makes it realistic, and the decisions it should force.
- Discussion, Simulation and Live Exercises: The Three Formats
A discussion-based tabletop talks through a scenario, a crisis simulation makes people act on it as it unfolds, and a live exercise has responders work real or replica systems. They test different things, and most programmes need more than one.
3 MIN READ
- What Makes a Cyber Crisis Scenario Realistic
A realistic scenario uses your own systems and threats, reacts to what players decide, runs against the clock, surrounds players with noisy information and makes wrong calls cost something. Most scripted tabletops have one or two of these; few have all five.
3 MIN READ
- The Decisions a Cyber Crisis Forces on Executives
A serious cyber incident forces executives to decide on containment that hurts the business, disclosure, regulators, customers, law enforcement, ransom and recovery order. An exercise should make each decision land on a named person with incomplete information and a deadline.
3 MIN READ
Designing and running
Objectives, facilitation, missing people and how often to exercise.
- How to Write Exercise Objectives That Can Be Scored
A useful objective names who must do what, by when, against which plan, so an observer can mark it met or not met. "Test our incident response" is a theme; "the crisis team decides on customer notification within 90 minutes of confirmed data loss" is an objective.
2 MIN READ
- Who Runs the Room: Facilitators, Platforms and AI
Someone has to pace the exercise, release information and press for decisions. That can be your own facilitator, a vendor or consultant, or software. Each choice moves effort and control between the organisation and the provider.
3 MIN READ
- Running a Crisis Exercise When Key People Cannot Attend
Most exercises are postponed because a key person cannot attend. Use named deputies, simulated stand-ins, asynchronous play or shorter sessions, and treat the absence itself as a finding, because the same person may be unavailable in a real incident.
2 MIN READ
- How Often to Exercise: Annual Tabletops, Quarterly Simulations and Microsimulations
Once a year is the floor many policies set, not a good cadence. A practical rhythm is one full cross-functional simulation a year, shorter decision exercises each quarter and very short individual drills in between, with each one testing a fix from the last.
3 MIN READ
Evidence and follow-through
Reports, measurement and the actions that should follow.
- What an After-Action Report Should Contain
A useful after-action report records what the exercise set out to test, what happened and when, which decisions were made on what information, what went well and badly, and a short list of fixes with owners and dates. Each finding should point back to the moment it came from.
3 MIN READ
- Measuring Decisions Under Pressure: Speed, Confidence and Alignment
You can measure how long decisions take, who made them, how confident people were and whether different roles agreed. You cannot easily measure whether a decision was right. Track the measurable things over time, and judge correctness in the review.
3 MIN READ
- From Findings to Fixes: Closing the Loop After an Exercise
Turn each finding into one action with one owner and a date, track the actions where the business already tracks work, report progress to the executive sponsor, and re-test the most important fixes in the next exercise. A finding that is not re-tested is not closed.
3 MIN READ
Frequently asked questions
Who are these lessons for?
Security leaders, crisis managers and risk teams who plan exercises for executives and incident responders. No prior exercise experience is assumed.
Do the lessons recommend a platform?
No. Where a lesson mentions a platform, it is to show how a step is done in practice. Recommendations live on the rankings page.