How long does a cyber tabletop exercise take?

The session itself is 3 hours. Counting a short briefing beforehand and the readout afterwards, your team spends about 5 hours in total. The written report follows within 15 days. From first conversation to the exercise actually running, allow three to seven weeks, and almost all of that is calendars rather than preparation.

Where do the three hours go?

Block	Minutes	What it is for
Framing	15	Ground rules and scope, and confirming nobody is being assessed personally
Scenario opens	30	The first decision, usually whether this is even an incident
Escalation	45	Notification and containment decisions start colliding
The hard turn	30	The inject nobody prepared for
Post-incident	30	What now. Where most rooms come apart
Hot wash	30	What was learned, said out loud while it is fresh

Three hours is a deliberate number in both directions.

Shorter and the post-incident block gets cut. That block is where the findings come from, because it is the only part of the scenario where the adrenaline has gone and somebody has to own the follow-up. Cut it and you get a session everyone enjoyed which evidences very little.

Longer and attention goes. Past about four hours a room starts giving the answer it thinks is expected instead of the answer it would actually give, and at that point you are measuring politeness.

Why does a decision take so long?

Because silence is part of the process, and it is longer than people expect.

A genuinely hard question buys a minute or two of nothing at all. Then three or four voices go, mostly circling, warming the room up. Then the fifth person says the thing that actually answers it. The whole cycle can run four or five minutes for one decision.

How long it takes depends on how well the team already works together, not on how clever they are. A group that talks daily gets there faster. A group meeting across functions for the first time takes longer, and that duration is itself a finding worth recording.

This is also why the facilitator matters more than it sounds. Somebody internal tends to fill the gap at about second thirty, because the silence feels like failure. It is not. It is the room thinking.

How long until you have to do it again?

Annually, on the evidence available.

Where testing is actually mandated, that is the cadence. New York’s financial services rule requires covered entities to test their incident response and recovery plans periodically, but at a minimum annually (NYDFS, 23 NYCRR 500.16(d), 2023). That rule almost certainly does not bind you, and it is the clearest published statement of what the industry has settled on.

The commercial version says the same thing in fewer words. Beazley’s Canadian application asks whether the plan has been Tested in last year (Beazley Cyber Application, Canada, 2026), which makes the date on your record the thing that matters rather than the fact of it.

So the practical answer is that a three-hour session plus fifteen days of report buys you about twelve months, and the clock starts on the day of the exercise.

What does the lead time actually cover?

Not preparation on your side. You send the current plan, confirm who is coming, and that is essentially it.

The three to seven weeks covers reading your plan properly, building a scenario that stresses the parts of it most likely to fail, and finding three hours when the people who make decisions are all free. That last item is usually the binding constraint, and it is why booking early costs nothing and waiting costs weeks.