Beyond the Breach: Why Your Tabletop Exercise Should be Your Worst Nightmare

The talk argues that tabletop exercises, structured discussions built around a scenario, let teams find gaps in incident response, disaster recovery and business continuity plans before a real incident. The speaker, a consultant with an offensive background who has written exercises for government and private clients, stresses that IT is central but that legal, communications, HR, executive leadership and finance also need a seat, since each handles regulators, press, staff and costs during an event.

The middle covers scenario design. Organizations should first identify their crown jewels, since a leaked client list matters far more to a bank than to a local bakery. Scenarios should be layered, ambiguous and tailored, sometimes informed by open-source research on the company or its vendors. Complexity has to be balanced so participants are challenged without being paralyzed. Losing a drill is the goal, because gaps found in a tabletop are far cheaper than gaps found mid-breach. Warning signs include unclear roles and shouting matches, and a missing network map or outdated contact list can derail the response.

The close covers follow-up. A lessons-learned session should capture what went well, and a remediation plan should assign owners, measurable actions and deadlines. The after-action report should be compared with earlier ones to confirm progress. Sessions of four to five hours work best, and scenarios should change each year to avoid fatigue. The takeaway is that tabletops should be an ongoing practice, not a compliance checkbox.