How it works
How a carrier-ready tabletop exercise works
We review your incident response, business continuity, crisis management and communications documentation. We agree with you who needs to be in the room. We build the scenario together and map it to MITRE ATT&CK and NIST CSF 2.0 and NIST SP 800-61. Then we run a three-hour facilitated session and deliver a written after-action report in 15 days, with a signed attestation naming who attended, for how long, and on what date.
Three stages. Only the middle one needs your team in a room, and it is three hours long.
Before the session
Roughly two weeks, and almost none of it is your time.
We read what you already have
Your incident response documentation, your business continuity documentation, your crisis management plan and your communications procedures. Not to grade them. To find out what the exercise should be testing, and where the plan makes assumptions nobody has checked.
We define who is in the room
We work through your structure with you and identify the groups that have to participate for the exercise to mean anything: executive, finance, legal and privacy, communications, operations, IT and security. Getting this wrong is the most common reason a tabletop produces nothing.
We build the scenario with you
Not a template and not something handed down. We design the incident alongside you, mapped to MITRE ATT&CK techniques and NIST CSF 2.0 and NIST SP 800-61, so it follows a path a real adversary would take against a company that looks like yours.
Stage two
What actually happens in the three hours?
A facilitated session, run live, with the whole group working one incident together. Information arrives in injects. Nobody gets the full picture at the start, because nobody does in a real breach. The facilitator holds the room to a decision at each point rather than letting it drift into discussion.
A representative shape for a ransomware scenario:
| Time | What lands | The decision the room has to make |
|---|---|---|
| 0:00 | Framing, ground rules, roles confirmed | Who is running this incident, and who speaks for the company |
| 0:15 | Inject 1 and 2. Anomalous activity, then confirmed encryption on a file server | Do we isolate, and what does isolating cost us today |
| 1:10 | Break | |
| 1:20 | Inject 3. A ransom note with a 72-hour clock, and evidence of exfiltration | Do we engage, do we pay, and who is authorised to decide that |
| 1:55 | Inject 4. A regulator notification threshold is crossed and a key client asks a direct question | What we say, to whom, and when |
| 2:30 | Inject 5. A journalist calls, and an employee has already posted about the outage | Who holds the line externally, and what the holding statement says |
| 2:50 | Hot wash | What broke, and what the room wants to change |
The discomfort is the product. A chatbot can ask whether you would pay the ransom. It cannot make your CFO and your Managing Partner disagree out loud and then land on an answer.
Stage three
What you get afterwards
A written after-action report within 15 days, and a signed attestation. The report contains:
- Scenario summary, and the MITRE ATT&CK and NIST mapping behind it
- Participants, and the role each of them played
- A timeline of the decisions the room made, and how long each one took
- Findings, and the gaps those findings expose
- Prioritised recommendations, each with a named owner and a date
- The signed attestation page
The attestation is the part you cannot produce yourself
Everything else in that list, you could write. Software can draft it, and increasingly does. The attestation is different. It is a one-page statement signed by the person who ran the exercise, recording the date, the duration, the scenario and the named attendees.
A report you write about your own exercise is a claim. An attestation is evidence.
That distinction is the entire reason an outside facilitator is worth paying for, and it is why auditors still exist in a world that has accounting software.
How this compares to the alternatives
| Free template, self-run | Your MSP or vCISO runs it | MyTabletops | |
|---|---|---|---|
| Who builds the scenario | You, from a generic pack | Your provider | Built with you, mapped to MITRE ATT&CK and NIST |
| Who runs the room | Someone who works for you | A vendor you already pay | An independent facilitator |
| Who writes the report | You | The same provider being assessed | The facilitator |
| Independent attestation | None | Not independent of your controls | Signed, named, dated |
| Conflict of interest | You assess yourself | They assess the environment they built | None |
| If the carrier rejects it | Your problem | Usually out of scope | We revise until accepted, no fee, no deadline |
What does "tested" actually mean to an underwriter?
Most renewal applications ask whether the plan has been tested in the past twelve months and leave "tested" undefined. The clearest published definition of that bar sits in New York's financial services cybersecurity rule, which requires covered entities to, in its own words, "at a minimum annually, test its incident response and BCDR plans" with the staff and management critical to the response, and revise them as needed.
Read what that sentence does and does not say. Not review the plan. Not update the plan. Test it, with the people who would actually be in the room. Canadian carriers ask the same question in looser language, and they mean the same thing. Whether or not you are regulated in New York, that is a fair working definition of the standard you are being measured against.
Organizations of 100 to 250 people that stopped a ransomware attack before encryption or extortion, against organizations of 3,001 to 5,000 people on the same measure.
Sophos, State of Ransomware 2026. Source
That gap is the whole argument for the mid-market. Companies your size are the least likely to stop an attack and the most likely to be asked, in writing, to prove they have practised for one. The average recovery cost across the same study was 1.7 million US dollars per incident before any ransom, up 11 percent year over year.
In Canada, Statistics Canada put the share of businesses impacted by a cyber security incident at 16 percent in 2023, with total business recovery spending roughly doubling to 1.2 billion dollars. Fewer incidents, each one costing considerably more. Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, released October 2024.
Or skip ahead: a 20-minute scoping call, where we ask about your renewal date, the plan you have now, and who would be in the room. If a tabletop is not the right thing for you right now, we say so.
Frequently Asked Questions
How long does a cybersecurity tabletop exercise take?
The facilitated session is three hours. Across the whole engagement your team spends about five hours: a scoping call, a short documentation handover, the session itself, and a readout when the report lands. Nobody outside the session needs to be involved.
Who should attend a cybersecurity tabletop exercise?
The people who would actually make the decisions in a real incident. Your CEO or Managing Partner, your CFO or COO, whoever owns communications, whoever owns legal or privacy, and your IT or security lead. Six to twelve people works best. Below five, the disagreements that make the exercise valuable never surface. We map the participant list with you before the scenario is written, because the scenario is built around who is in the room.
Is the scenario mapped to a recognised framework?
Yes. Every scenario is mapped to MITRE ATT&CK techniques and to NIST CSF 2.0 and NIST SP 800-61, so the exercise tests a real adversary path rather than a generic story, and so the after-action report speaks the language an underwriter, an auditor or an enterprise customer already reads. The mapping is shown in the report.
What does a cyber tabletop after-action report include?
Scenario summary and framework mapping, participants and the role each played, a timeline of the decisions the room made and when, findings, the gaps those findings expose, prioritised recommendations each with a named owner and a date, and the signed attestation page. It is written to be handed to a broker, an underwriter or an auditor without editing.
What is a signed attestation for cyber insurance?
A one-page statement, signed by the facilitator who ran the exercise, recording that the exercise took place: the date, the duration, the scenario, and the named people who attended. It is the only part of the deliverable you cannot produce yourself, because the whole point is that an independent third party is confirming it. A report you write about your own exercise is a claim. An attestation is evidence.
Can we run a tabletop ourselves with a free CISA or government template?
You can, and for building internal muscle memory you should. What a self-run exercise cannot produce is third-party attestation. You end up attesting to your own exercise, which is the specific thing a renewal questionnaire, a security questionnaire or an auditor is trying to get past. Run the free template quarterly. Bring in a witness for the one that has to hold up.
Do we need to have an incident response plan before we start?
It helps, but it is not a prerequisite. We work with what you have. If the plan is thin or out of date, that shows up in the exercise and lands in the report as a prioritised gap with an owner and a date, which is usually more useful than a polished plan nobody has pressure-tested.
What happens if our insurer does not accept the report?
We revise it until they do. No extra fee, no deadline, no argument. That is the Carrier Acceptance Guarantee, and it exists because you are buying proof. If it does not work as proof, it is not finished.