Table Top Exercises for Incident Response Plans

Your IR Plan Isn’t Real Until People Practice It

We’ve reviewed dozens of incident response plans that look bulletproof in a Word document. Flowcharts are crisp. Escalation procedures are defined. Call trees are documented. Then a real breach happens, and the team discovers the CISO’s number is wrong, the legal contact doesn’t exist anymore, and nobody actually knows what “isolate the affected system” means in your environment.

This is why table top exercises—structured, facilitated simulations of security incidents—matter far more than the plan itself. The plan is just the starting point. The exercise is where you find out if it actually works.

We’re not talking about checkbox compliance. We’re talking about the difference between a coordinated response and chaos.

What Makes a Table Top Exercise Actually Useful (Not Just Theater)

A good table top exercise is a controlled simulation where your team responds to a realistic incident scenario in real time—without real damage, without the clock ticking at full speed, and with a facilitator who can pause and ask hard questions.

Here’s what separates a real exercise from security theater:

It’s scenario-driven, not checklist-driven. You present a situation (“We just detected suspicious admin logins from Russia at 3 AM”) and let the team respond. Real incidents are messy. Your exercise should be too.
It forces cross-functional conversation. Security, operations, legal, communications, and leadership sit in the same room. That’s where you discover that nobody told finance why they’re about to spend $500K on forensics.
It surfaces gaps before they matter. Missing contact info. Unclear authority boundaries. Outdated system inventories. Tools people don’t know how to use. An exercise finds these without the pressure of a real breach.
It builds muscle memory. Running through incident response repeatedly means people know their roles. When the real thing happens, panic is lower and decision-making is faster.
It’s documented and improved. A proper exercise produces an after-action report (AAR). You record what worked, what didn’t, and what you’re fixing. Then you actually fix it.

From the field: The “I thought we had a plan” moment

We ran a table top with a mid-market retailer last year. Their IR plan said “notify the board within 4 hours.” When we asked who notifies them and how, they paused. Turns out the board secretary doesn’t check email on weekends. The general counsel was on maternity leave. The CFO’s contact number was from three years ago. On paper: airtight. In practice: impossible. The exercise found this. A real incident would have exposed it at the worst possible time.

The Anatomy of a Useful Table Top Exercise (How to Actually Run One)

You don’t need a fancy consulting firm to run a decent exercise—though an external facilitator adds objectivity and keeps people honest. Here’s the structure we recommend:

Phase 1: Planning (2-3 weeks before)

Define your scope and scenario. Are you testing ransomware response? Data exfiltration? Supply chain compromise? Pick something relevant to your risk profile. Build a realistic scenario with specific details—not “a threat actor attacks us” but “we discovered encrypted files on our file server and a ransom note demanding 50 BTC, signed by LockBit, who claims they exfiltrated 2TB of customer data.”

Set clear objectives. What do you want to learn? Are you testing decision-making speed? Inter-team communication? Vendor response? Know what success looks like.

Brief participants in advance. Send them the scenario 24 hours before, but don’t let them prepare detailed responses. You want to see how they actually think and prioritize, not a rehearsed performance.

Phase 2: Execution (2-4 hours, depending on complexity)

A facilitator walks through the scenario in phases, introducing new information as the “incident” develops. The team responds in real time, making decisions and assigning tasks. You’re not looking for the “right” answer—you’re watching how they decide, who they loop in, what they ask for, and where friction appears.

SAMPLE EXERCISE TIMELINE:

T+0:00 - Initial detection reported
         Team identifies what they know and don't know
         First escalation decisions

T+0:30 - Facilitator provides new data (more affected systems found)
         Team adjusts response, assigns forensics tasks

T+1:00 - Legal/leadership implications emerge
         Disclosure timeline decisions
         Customer notification considerations

T+1:30 - Executive debrief and wrap-up

Keep it realistic but not overwhelming. You’re not trying to traumatize people—you’re trying to expose assumptions and gaps. A good exercise leaves people thinking “oh, we need to fix that” not “I never want to do this again.”

Phase 3: After-Action Review (1-2 weeks after)

This is where exercises actually improve your security posture. Document what happened, what the team discovered, and what needs to change. Assign owners to fixes. Actually follow up on them.

Advisory note: We’ve seen organizations run beautiful exercises and then file the AAR in a drawer. That’s wasted effort. The exercise only matters if you act on what you learned.

What You’re Actually Testing (And What Surprises You’ll Find)

A well-run table top almost always exposes the same categories of problems:

Authority and decision-making. Who can authorize containment? Who decides on disclosure? Who talks to the press? Often: nobody is actually sure.
Communication bottlenecks. The CISO’s Slack is down, so critical messages don’t get routed. The forensics vendor’s primary contact is unavailable. These details kill response speed.
Tool knowledge gaps. You have a SIEM, but the on-call analyst has never built a hunt query. You have an EDR tool, but ops doesn’t know how to isolate a system remotely. Exercises find this immediately.
Unclear scope and sequence. People disagree on whether forensics happens before or after containment. Finance doesn’t understand why you need to spend money on external help. These arguments happen in the exercise, not at 2 AM during a real incident.
Outdated information. The backup system we’re supposed to restore from doesn’t exist anymore. The third-party we’re supposed to notify hasn’t been our vendor for two years. Real exercises catch this.

How Often Should You Be Running These? (Spoiler: More Than Once a Year)

We recommend at least two exercises per year for most organizations—a full IR exercise and a focused drill on a specific capability (e.g., backups, forensics, communications). If you’re in a highly regulated industry or have a history of incidents, quarterly is reasonable.

Don’t make every exercise identical. Rotate your scenarios. Test different response paths. One year: ransomware. Next: insider threat. Then: supply chain compromise. You want to build muscle memory across different incident types, not just perfect one response playbook.

And don’t let your team know the exact scenario in advance. A little uncertainty keeps people sharp and prevents rehearsed, performative responses.

The One Thing That Changes Everything

The single biggest difference between exercises that improve security and exercises that are just theater: whether you actually fix the things you discover.

Run the exercise. Document the gaps. Assign owners. Set deadlines. Follow up. If your IR plan is weak, your next exercise should be stronger because you fixed specific things. That’s the cycle that matters.

If you’re not doing this yet, start small. You don’t need a consultant or a two-day event. Pick a realistic scenario, block two hours on your calendar, gather your critical responders, and run through it. Document what breaks. Fix one thing. Do it again in six months.

That’s how you build an IR team that actually works when it matters.

What You Should Do This Week

Pick a date in the next 60 days for your first table top exercise—or your next one if you’re already running them. Define one realistic incident scenario based on your top risk (ransomware, credential compromise, or data exfiltration—pick the one that keeps your CISO up at night). Send calendar invites to security, ops, legal, and one executive. Plan for two hours. Assign someone to facilitate and document what happens. That’s it. You don’t need permission or budget to start learning what actually works in your environment.