A tabletop exercise is a simulation in which executives and leaders discuss the decisions they would make in a crisis scenario presented in stages. It does not test technology. It tests who decides, using what information, how quickly, and who communicates what to whom.
In a real attack, leadership decides whether to halt operations, pay the ransom, when to notify the regulator, and what to tell customers. A tabletop exercise allows those decisions to be made calmly for the first time, outside an incident.
Pressure on these decisions is likely to grow. The Global Cybersecurity Outlook 2026, from the World Economic Forum, shows that 64% of organizations already consider geopolitically motivated attacks in their risk strategies, and the FBI received over 1 million cybercrime reports in 2025, with reported losses of US$20.9 billion.
How to design the exercise
The first step is defining the objective: testing decision-making, external communications, activation of the continuity plan, or the relationship with the regulator. An exercise that tries to test everything loses focus. Participants should be the people who would be in the room during a real incident: the CEO or executive leadership, operations, legal, communications, technology, security, finance, and HR.
The scenario should be realistic and grounded in the company's risks, preferably the scenarios prioritized in the business impact analysis. It progresses through injects, each introducing new information that requires a decision: a system went down, a journalist called, a ransom note arrived, or the regulator requested information.
Facilitation and debrief
An external facilitator runs the exercise, manages time, probes vague answers, and records gaps. Internal facilitators tend to be more lenient with their own leadership.
The debrief is the most important part: what worked, what stalled, who did not know their role, and which decisions had no owner. It produces an action plan with owners and deadlines. Two to three hours are usually enough for the complete exercise.
Questions the tabletop exercise needs to test
If the room cannot answer one of them within a minute, the exercise has already uncovered a gap:
- Operations: who can order operations to stop, and who decides if that person cannot be reached?
- Ransom: who decides whether to pay, and on what basis?
- Mandatory notifications: when should the ANPD, data subjects, and sector regulators be notified, and who signs off?
- Press: who speaks, and what do they say in the first two hours?
- Customers and partners: who sends notifications, and through which channel, if email is compromised?
- Insurance: has the insurer been contacted, and who has the policy details?
Fictional example: the journalist who called first
In a tabletop exercise with a food manufacturer's executive team, the scenario is ransomware at the main plant. The first injects go well: the committee convenes, IT isolates systems, and legal evaluates mandatory notifications.
In the fourth inject, a journalist calls about the attack after seeing an employee's post. Communications thinks the issue belongs to legal, legal thinks it belongs to the CEO, and nobody had considered that the news might leak from within. The adjustment includes a spokesperson and backup, a preapproved initial statement, and employee guidance on posting during a crisis.
Mistakes that reduce a simulation's value
Generic scenarios unrelated to the company are treated as academic exercises. When executives send substitutes, the exercise tests people who will not make decisions in a real event. Scripts that accept every answer validate the plan without testing it, and the absence of a debrief causes lessons to be lost.
The exercise should take place at least once a year with executive leadership and whenever there is a significant change in leadership or the continuity plan. The scenario is a surprise; the format is not: everyone needs to know that mistakes are expected and that the goal is to find gaps. To test technical execution, the complementary exercise is the Cyber Wargame.
Expert-led crisis simulations
Vultus conducts tabletop exercises using scenarios based on company risks and turns identified gaps into adjustments to the continuity plan. Explore Vultus crisis simulations and tabletop exercises and read about the first 48 hours of a ransomware attack.
