Who runs cybersecurity tabletop exercises in Canada?

Six kinds of organisation run cybersecurity tabletop exercises for Canadian businesses: managed security providers, incident response firms, the large consultancies, sector bodies running them for members, independent specialist facilitators, and conference-style exercise events. Almost none publishes a price. Every one of them can run a competent session, so the choice is rarely about capability. It is about what you need to be able to show afterwards, and whether the organisation running it is in a position to confirm anything about you.

Who is actually in the market?

Managed security providers. Canadian MSSPs and managed IT providers increasingly offer tabletop exercises alongside monitoring and response services. Some publish a starting price, which is unusual in this market. The exercise is frequently a way into a broader managed relationship, which is a normal and legitimate way to sell, and the session you get can be genuinely good.

Incident response firms. Firms whose main business is responding to live incidents, several with Toronto offices. Deep practical expertise, because they have watched real versions of the scenario. Usually structured around retainers and scoped for larger organisations. Some talk about tabletop exercises in their published material without listing them as a service, so check what is actually on offer before assuming.

The large consultancies. They do this in Canada and say so. PwC Canada’s cyber crisis page lists Organizing and facilitating cyber crisis exercises (tabletops, functional exercises or simulations) among its services (PwC Canada, Cyber crisis response, 2026). No rate card is published by any of them. Engagements are scoped for organisations considerably larger than the Canadian mid-market.

Sector bodies and industry associations. Real, and in some sectors substantial. The North American electricity sector runs GridEx, a biennial grid security exercise whose most recent edition included an executive tabletop and named Natural Resources Canada, the Canadian Centre for Cyber Security and the Canadian Armed Forces among participants (NERC and E-ISAC, GridEx VIII Lessons Learned Report, 2026). If you are in a regulated sector with an active association, ask them first. It may cost you nothing.

Independent specialist facilitators. Small firms and individuals who do this and not much else. Usually the cheapest route to a genuinely independent facilitator. Quality varies more here than anywhere else on the list, because there is no filter.

Conference-style exercise series. A newer category: ticketed multi-city exercise events aimed at executives and security leaders, run as a series across Canadian cities. Useful exposure and networking. Not a substitute for an exercise built around your own plan, and not something that produces a document about your organisation.

What is not on this list

Government, for the private mid-market.

The Canadian Centre for Cyber Security recommends the practice. Its emergency preparedness guidance says to Run a tabletop exercise with the key employees identified in the plan (Canadian Centre for Cyber Security, Improving cyber security resilience through emergency preparedness planning, ITSM.10.014, 2026). But it publishes no scenario pack, no facilitator guide and no templates of its own, and points readers to NIST and SANS instead. It does not run exercises for individual businesses.

Public Safety Canada runs a critical infrastructure exercise programme, aimed at critical infrastructure owners and operators. A fifty to three hundred person professional services firm is unlikely to qualify.

If you want a free kit to run yourself, the published ones come from the United States, the United Kingdom and the Government of British Columbia. Canada’s federal cyber agency is not among them.

How do the categories compare?

Category	Publishes a price	Independent of your environment	Typically produces a written report	Scoped for 50 to 300 people
Managed security provider	Sometimes, starting-from	No, if they operate your environment	Varies	Often
Incident response firm	No	Usually	Yes	Rarely
Large consultancy	No	Yes	Yes	No
Sector body or association	Usually free to members	Yes	Sector-level, not about you	Varies
Independent facilitator	Rarely	Yes	Varies	Yes
Exercise event series	Ticketed	Not applicable	No	Not applicable
MyTabletops	15,000 CAD, fixed and published	Yes	Yes, in 15 days	Yes

The independence column is the one people skip and then discover late.

Why the independence column matters

Not because a rule requires it. None of the regulations, carrier applications or vendor questionnaires we reviewed requires incident response testing to be run or witnessed by a third party, and anyone telling you otherwise is mistaken. They all ask whether the plan was tested. None of them asks who ran it.

It matters because of what the resulting document can say.

A provider who built and operates your environment can run an excellent exercise. What they cannot do is credibly confirm that the environment’s incident response was independently tested, because the response being tested includes their own work and, frequently, their own staff. That is not a criticism of them and it is not about effort. They are often the best-placed organisation in the room to help design a realistic scenario. They are just not in a position to be the witness to it.

The same logic applies in a smaller way to a firm that has done other security work for you. Worth a thought, not a veto.

What should you actually ask a provider?

Five questions, and the answers tell you more than a capability deck.

What do we get in writing, and how long after the session? A written after-action report with findings and owners is the deliverable. If the answer is a debrief call and some slides, you are buying an afternoon, not an artifact.

Who facilitates, and have they run a response, not just an exercise? Facilitation experience and incident experience are different things and both help.

How is the scenario built? A scenario written against your actual plan will find more than one lifted from a pack, and you are paying for that difference.

Will the report contain findings if the room does badly? It should. A report with nothing in it reads as a demonstration.

And can you confirm in writing that the exercise took place, and that you were independent of our response? For some buyers the answer does not matter at all. For anyone who has to hand the document to an underwriter or an auditor, it is the question that decides between the categories above.

Two follow-ups are worth having ready if the answer is yes. Independent of what, exactly: have they done other security work for you, and does the person signing have any role in the response being described? And what does the statement actually say, because a line in a covering email is not the same artifact as a signed page inside the report. Neither question is a trap. A provider who has thought about independence will answer both immediately, and one who has not will improvise, which tells you what you needed to know.

A fair word about the cheapest option

If you are choosing between a provider on this list and running one yourself from a free public kit, the self-run exercise is a real option and a good one. The published packages are professionally built, they cost nothing, and a self-run session will surface genuine problems.

What it will not do is give you a document produced by somebody other than you. That is the only thing on this page that money actually buys.