What does a cybersecurity tabletop exercise cost in Canada?

A facilitated exercise with a written report and an attestation costs 15,000 CAD with us, fixed, with the Extended Exercise Record a further 8,000 if you need it. Beyond that, the honest answer is that there is barely a market price to quote. Almost no provider publishes a number, no government body or industry association publishes a benchmark, and the figures that circulate online mostly trace back to nobody. The few providers anywhere who do publish sit somewhere between about 4,000 pounds and the high single-digit thousands per exercise.

Why is it so hard to find a price?

Because hardly anyone publishes one. We went and checked.

Among the large incident response and security firms, the pattern is consistent: a detailed service description, a list of what the exercise covers, and no number anywhere. Requirements-based pricing, discussed on a call. That is a legitimate way to sell a scoped service and it is not a criticism. It just leaves anybody trying to build a budget with nothing.

The public sector does not fill the gap either. NIST’s guide to test, training and exercise programmes is the governing standard for how these should be run, and it contains no cost figures at all (NIST Special Publication 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, 2006). US federal procurement schedules price hourly labour categories and carry no line item for a tabletop, so even there you would be building a number out of hours. No Canadian body publishes anything comparable.

So when you see a confident figure for what a tabletop “typically” costs, ask where it came from. In most cases the answer is another page that also did not say.

What do the providers who publish actually charge?

Three reference points. Each is the provider’s own published price, not an estimate somebody made about them.

The cleanest is a UK firm that filed its rate card to a government procurement framework, listing a tabletop exercise at a fixed 4,000 pounds and a live-play version at five thousand (Pentest People Limited, pricing document filed to UK G-Cloud 14, 2024). Dated, fixed, and filed with a government buyer, which makes it about as solid as a published price gets.

Another UK provider publishes five tiers on its own site, from an executive awareness session under a thousand pounds up to a technical crisis exercise at 4,395 pounds for the executive tier and around seven and a half thousand at the top (Cyber Management Alliance, published tabletop exercise pricing, 2026). Worth noting that the same company’s government filing quotes a day rate instead, and the two do not reconcile neatly.

In Canada, some managed security providers publish a starting price for a tabletop. Read those carefully, because a starting price is a floor rather than a quote, and because the economics are different, which is the next section.

Converted roughly, the published band runs from about seven thousand Canadian dollars to about thirteen. Ours sits above it, and what you pay the difference for is the attestation.

What are you actually choosing between?

Option	Published price	What it produces	Independent attestation
Self-run from a free template	Free	A real exercise, and findings you would not otherwise have	No
Your MSP or MSSP runs it	Sometimes, often a starting price	A competent exercise in an environment they know well	No, structurally
A specialist provider	Rarely	A scoped exercise and a written report	Usually yes
Incident response firm	No	Deep expertise, enterprise scoping	Yes, at enterprise pricing
Big Four or large consultancy	None published. We have seen upwards of 70,000 CAD	Excellent work, scoped for much larger organisations	Yes
MyTabletops	15,000 CAD fixed	Three hours, an eight-section report in 15 days, a signed attestation	Yes

Two of those rows deserve more than a table cell.

Free is a real option and we help you take it. CISA publishes complete exercise packages, and we publish our own three-hour agenda and report template. Run it in house. It costs an afternoon and it will find things. Then read the incident response question on your application again, because the gap is not quality. A self-run exercise produces no third-party confirmation that it happened.

Your MSP is probably the most common choice, and it is not a bad one. Managed providers sometimes price a tabletop at or below what it costs them, because it is a way into an account and the managed services follow. That is a real business model, not a trick, and the exercise you get can be genuinely good. The limitation is structural, and nothing to do with effort: a provider who built and operates your environment cannot independently confirm that the environment’s response was tested, because they would be attesting to their own work. They are a strong candidate to help design the exercise. They cannot be the witness to it.

Big Four and large consultancies publish no rate card, so there is no page anybody can send you. What we can tell you is what we have seen: comparable exercises priced upwards of 70,000 CAD, often running a scenario the firm has delivered many times before. That is our own observation and not a market rate, because no published figure exists to check it against. The work is good. It is scoped for organisations far bigger than a fifty to three hundred person firm, and the artifact at the end is the same category of document.

Does a cheap exercise put your insurance at risk?

You may have read that a carrier voided a cyber policy because the insured had not really tested its incident response plan. It is a good story and it is not true, and it turns up often enough on pages about cost that it needs correcting here.

The case people mean is Travelers Property Casualty Company of America v. International Control Services, Inc., No. 22-cv-2145 in the United States District Court for the Central District of Illinois. Travelers filed in July 2022 to rescind a cyber policy, and order and judgment were entered at the end of that August, declaring the policy void from inception.

The alleged misrepresentation was about the scope of multi-factor authentication. It had nothing to do with incident response plan testing.

The real risk is narrower and does not need the embellishment. An answer on an application is a representation made to obtain a contract, and a material misrepresentation about a control is grounds for rescission. That principle is real and the carriers’ own forms say so. It simply was not what that case decided.

So no, a cheaper exercise does not endanger your policy. An answer you cannot evidence is the thing to avoid, and that is a question about what the exercise produces rather than what it cost.

What does the failure actually cost?

Hold that against any of these numbers. Canadian businesses spent 1.2 billion dollars recovering from cyber security incidents in 2023, roughly double the 2021 figure (Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, 2024). About 16 percent of businesses were impacted that year (Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, 2024).

We are not going to lean on that, because scaring people into a purchase is how the Travelers story spread in the first place. The narrower point: the exercise is a small number against the thing it is meant to help with, and the decision is usually about evidence, not risk reduction.

When do firms actually buy one?

Here is the pattern we see most often, and it is not the one the brochures describe.

A company buys a large package from a big cyber firm, frequently on a retainer, and then does not use the whole thing. Money is left over with a date on it. So they spend the remainder on a tabletop exercise, and because the purchase is about clearing a budget, what arrives is rushed and templated. It tends to be overpriced as well, which in a strange way suits everyone: the firm books the revenue, and the client has something to show for the money.

Nobody is cheated. It is still a poor use of the funds, and it produces an exercise nobody in the room asked for.

If you are the person holding leftover budget, that is not a reason to avoid this. It is a reason to be specific about what you are buying. A named scenario, a fixed scope, a written report and a dated attestation will still be working for you a year from now. A session bought to clear a line will not.

If there is no budget at all, the free route above is genuinely available, and the honest gap between it and this is one page at the back of the report.

What moves the number?

Scope, mostly. How many participants, how many scenarios, whether an existing plan needs reading beforehand, and how deep the written analysis goes. Difficulty is set by how mature the team is rather than by anything we choose: a room that has never done this gets a contained incident, and a room that has gets a crisis.

Our price does not move with any of that, which is the point of publishing it. Three hours, an eight-section report in 15 days, an attestation, 15,000 CAD. The Extended Exercise Record adds 8,000 when a regulator, an auditor or a claims reviewer is the expected reader.