Gamification of Tabletop Exercises

Kelly Ohlert, a longtime tabletop role-player and scenario designer, opens by contrasting standard tabletop exercises with tabletop games. Exercises, as government bodies describe them, are discussion sessions that test incident response and continuity plans, often driven by regulatory checklists. She argues that these sessions tend to be dull, stressful and forgettable, and that game design can help lessons stick.

The middle of the talk walks through a sample scenario about a fictional cat-photo startup with a small security team, a limited budget and a consensus-based spending rule. Players receive character classes that differ from their day-job roles, so legal, executives and engineers see each other's perspective. Ohlert then covers three recurring problems: teams that rarely meet, one dominant participant who holds all the institutional knowledge, and a room that is half asleep. Her fixes include special player abilities, removing a talkative player through an in-game event, and opening with a catastrophic regional outage to wake people up.

She closes by encouraging facilitators to treat exercises as an evolving journey rather than a static check, and points to existing tabletop gaming resources for incident response practice. The practical takeaway is that inexpensive, creative scenario design can expose coverage gaps, improve cross-team understanding and produce clearer evidence of lessons learned for auditors.