Why Tabletop Exercises Expose More Than Technical Weaknesses

Tabletop Exercises Can Uncover Process and Coordination Gaps  

It’s during these scenarios when the parties discuss their procedures and the chain of command. The technical exercises are designed to let IT departments know where their security issues lie, but what ends up happening is that other, nontechnical issues arise that need to be addressed. 

Even small businesses will have many individuals involved in a real cybersecurity incident, from a low-level IT staffer to the CIO and CEO, and from the firm’s outside attorney to its cyber insurance company. All play a role. 

“The biggest findings are almost always about process and coordination,” says Jess Burn, a principal analyst at Forrester. “Exercises reveal whether people agree on incident severity, who has authority to shut down a system, when executives or the board get involved, who approves customer or media communications, and when to contact the cyber insurance representative.” 

While the plans may look clear on paper, says Burn, different departments might be operating on different-enough assumptions to cause issues. An effective tabletop exercise is designed to throw untested situations at its participants and get them to rely on their instincts. 

GET THE DETAILS: Why is mobile API security under scrutiny? 

“A simulated event that was not announced, where people are not prepared, will expose the fundamentals: What can I do right now to contain, and who do I contact to help with next steps?” says Hinton. “These are exceptionally valuable and very hard to implement in a manner that gets the adrenaline going in a way that actually simulates — and stimulates — the response process.” 

It’s not supposed to be a “clean” exercise, where everyone feels good at the end, according to Hinton: “The incident response team knows what to do, how to respond to contain an incident. The executive team needs to be taken on the journey of ‘this is what happened, this is what we did to fix it’ without understanding the details of the environment or trying to second-guess the trained subject matter experts in the security operations center and on the incident response team. This is extraordinarily difficult for most senior leaders who are used to making and owning decisions based on a full analysis of situation, impact, options and so on.” 

How Often Should Tabletop Exercises Be Run? 

It’s such gaps in communication and execution that lead Burn to think that these exercises should be run on a regular basis, ideally before an incident happens. “I recommend at least one cross-functional executive tabletop each year, supported by more frequent technical drills using a cybersecurity skills and training platform with a cyber range that provides a realistic simulation of the organization's environment,” she says.

However, the frequency may vary, according to Hinton. If a business is always in “fire drill mode,” tabletop exercises probably need to be run less often than in organizations where there are fewer attacks, she says. 

However frequently they run them, businesses need to come out of each exercise with a plan of action for each participant. “Organizations should leave the exercise with an owner, deadline and expected outcome for each finding,” Burn says. “Some fixes, such as updating contact lists or drafting communication templates, can happen quickly. Issues involving authority, governance, contracts, staffing or business continuity usually take longer.” 

DIVE DEEPER: Five questions every organization should answer before the next cyberattack.

The hardest fixes are those involving gaps in authority, she says, “because the security team cannot resolve them alone. Deciding who can take a critical system offline, approve an emergency expenditure, determine materiality or speak publicly requires agreement across legal, financial, operational and executive teams.” 

Tabletop Exercises Are Made More Complex by New Tech 

Scenarios that are used in tabletop exercises are only going to get more complicated, given advances in technology. “Exercises will become more dynamic as AI-enabled attacks create faster-moving incidents and messier evidence trails,” Burn says. “Scenarios will need to account for prompts, model outputs, agent actions, data pipelines, access controls and human approvals alongside endpoint, identity, cloud and network evidence.” 

Quantum computing cyberattack scenarios being developed are especially important, given the fact that algorithms that can crack current cryptographic systems are ready to be implemented by bad actors as soon as the technology is mature. 

But just as new technology can make the scenarios more complicated, they can also help design those scenarios and guide their users to effective solutions. AI-powered exercises can react dynamically to changing conditions and decision-making. 

EXPLORE: The critical success factors that help MDR close security response gaps.

“This means that teams must be empowered to act, prepared to respond, and have the alerts and responses to allow them to act at as close to machine speed as they can,” says Hinton. “The muscle memory is moving from people to instructions given to autonomous AI defenders.” 

Despite those advantages, however, Burn still thinks that the human element is key: “AI can help create realistic tabletop injects and adapt scenarios based on participants’ decisions, but human facilitators still need to validate the content.”