Security Readiness

Tabletop Exercises

Facilitated scenario-based exercises that help teams practice incident response decisions in a controlled environment.

Talk to an operatorSee the engagement
Three connected volumes representing Security, IT, and Leadership roles practicing handoffs under pressure

The Open Security Experience

Where this service sits.

Discover → Validate → See and Act → Improve. This engagement lights the stages that match how Open Security delivers it — and stays connected to the rest of the experience.

  1. 01DiscoverSee where risk lives.
  2. 02ValidateProve what actually works.
  3. 03See & ActPrioritize and close it.
  4. 04ImproveGet stronger next cycle.

The problem

Incident response plans need to be rehearsed.

Incident response procedures exist in documentation, but the people who would execute them have not rehearsed together. The first real incident should not be the first time the team works through the handoffs.

  • Playbooks are written for roles that have never rehearsed the decisions together.

  • Escalation paths look clear on a diagram but break down under time pressure.

  • After-action notes from past incidents do not become exercises the team can run again.

Where it breaks

  • 01

    Security

    No clear call.

  • 02

    IT

    Escalation stalls.

  • 03

    Leadership

    Evidence is late.

Communication gaps appear between teams under pressure.

How the engagement is run

The work, from context to follow-through.

Operators run the engagement. You stay in the decisions that shape scope, evidence, and what gets closed.

What's in scope

  • Scenario selection: ransomware, supply chain, or zero-day exercises
  • Facilitated session with cross-functional participants
  • After-action review and SOP gap analysis

The relationship

Repeatable exercises

Scenarios based on real-world incidents (ransomware, supply chain, zero-day response) can be run multiple times to compare how the team responds.

  1. 01

    Scenarios branch based on participant decisions, with each choice leading to different outcomes.

  2. 02

    After-action reviews identify SOP gaps and improvement areas.

The Open Security difference

How the exercises work

  1. 01

    Built-in discussion prompts and pause points guide the session.

  2. 02

    Exercises focus on team discussion rather than scoring.

Outcomes

What is different when you leave.

  1. 01

    After-action review of the decisions made during the exercise

  2. 02

    SOP gap identification and improvement recommendations

Related capabilities

What complements this engagement — and what teams typically run next.

Common questions

Who should participate?

Security, IT, Legal, and Leadership: the people who would decide and escalate during an incident.

What scenarios are available?

Ransomware, supply chain, and zero-day response scenarios based on real-world incidents.

What platform do you use?

rTable, an interactive scenario platform designed by incident responders. Browser-based, no downloads required.

Can we run the same scenario again?

Yes. Scenarios can be run again to compare how the team responds.

Plan a tabletop exercise

Talk to an operator about tabletop exercises for your team: the scenarios that match your environment and the roles that need to practice together.

Talk to an operator