Run the tabletop before the attacker does

Key takeaways

• The goal of a tabletop is to find where the plan breaks under load, not to rehearse a happy path everyone already agrees on.
• Inject realistic friction — missing people, time pressure, competing demands — because that's the condition a real incident imposes.
• An exercise with no dated follow-up backlog, re-tested next quarter, was theater rather than preparation.

If everyone passes, it was too easy

A tabletop exercise that everyone passes comfortably has taught you almost nothing. The entire point is to find where the plan breaks under load — the decision no one actually owns, the emergency contact list that went stale six months ago, the quiet assumption that backups are instantly and completely restorable. If your exercise never produces an uncomfortable discovery, it was designed to reassure rather than to test.

Design for friction

Inject realistic curveballs mid-scenario: the incident response firm's retainer contact has left the company, the backup administrator is on leave, legal wants the leak site screenshotted before it's taken down, and communications needs a holding statement drafted in the next thirty minutes. Force real decisions against real time pressure, because that is the condition a genuine incident imposes. A scenario without friction rehearses a fantasy.

Get the right people in the room

A ransomware event is a business crisis, not an IT ticket, so the table should include legal, communications, finance, and executive decision-makers alongside IT and security — and operational or OT leadership where production is at stake. Many of the most damaging gaps live in the handoffs between these functions, and you only find them when they are all present at once, discovering in real time that no one is sure who authorizes what.

The follow-up is the whole point

Afterward, produce a short list of dated action items with named owners, and re-run the same scenario the following quarter to confirm the gaps actually closed. An exercise that generates no follow-up backlog, and is never repeated, was theater rather than preparation. The value isn't the day in the room — it's the fixes the day forced you to find, and the proof next quarter that they held.