Rehearse the decisions that matter.
Facilitated, threat-led cyber tabletop and live-play exercises for boards, executives and incident responders. Built on credible threats to your organisation, observed against clear criteria, and finished with an action plan you can evidence to regulators.
A supplier incident reaches a critical service.
The first time you make these decisions shouldn’t be during a real incident.
Incident plans describe what should happen. Exercises show what actually happens — who decides, how quickly, with what information, and where the plan breaks.
Our exercises are threat-led: scenarios come from the same intelligence work that underpins our threat-led testing, so participants rehearse against attacks that could realistically happen to them — not a generic script.
Four ways to run an exercise.
Executive tabletop
For boards and senior leaders: strategic decisions, communications, regulatory obligations and business impact.
Technical tabletop
For responders: detection, triage, containment, investigation and recovery decisions.
Combined exercise
Leadership and responders together, testing the escalation and information flow between them.
Live-play simulation
Timed injects delivered in real time — simulated emails, calls and media enquiries — to test pace and pressure.
Credible scenarios, tailored to you.
Every scenario is adapted to your organisation, sector and threat picture. Common starting points include:
Ransomware and data extortion
Encryption of key systems combined with a threat to publish client data.
Supplier compromise
A breach at a critical third party that reaches into your environment or services.
Payment diversion
A compromised mailbox used to redirect a high-value client or supplier payment.
Cloud and identity compromise
Stolen credentials used to take control of cloud tenants and administrative access.
Insider data theft
A trusted insider exfiltrating sensitive data before leaving the organisation.
Disruption of a critical service
A sustained attack that takes a client-facing service beyond its impact tolerance.
AI system misuse
An AI assistant or agent manipulated into leaking data or taking unauthorised actions.
Threat actor-specific scenario
Built around a named actor assessed as likely to target your sector.
TLPT rehearsal
Preparing a control team for the confidentiality and decisions of a threat-led test.
Design. Facilitate. Observe. Improve.
Design
Scoping workshop, objectives, participants and a threat-led scenario with timed injects.
Facilitate
An experienced facilitator runs the session, remote or in person, keeping it realistic and on track.
Observe
Performance observed and recorded against criteria agreed in advance.
Improve
Findings, prioritised actions with owners, and a route to verify they’re closed.
Clear criteria, not impressions.
Observation criteria are agreed before the exercise, so findings are objective and comparable over time.
- Decision-making — timeliness, authority and quality of key decisions.
- Escalation — whether the right people were involved at the right time.
- Communication — internal, client, supplier and media communications.
- Regulatory obligations — recognising and acting on incident classification and notification duties.
- Third-party coordination — working with critical suppliers under pressure.
- Recovery priorities — restoring important business services within impact tolerance.
Evidence you can use.
After-action report
What happened, what worked and what didn’t, with findings rated by significance.
Prioritised action plan
Specific improvements with owners and target dates, ready to track to closure.
Leadership summary
A concise briefing for the board or risk committee on readiness and priorities.
Resilience evidence
Material to support DORA and FCA operational resilience self-assessments and scenario testing.
Exercises that support your obligations.
- DORA expects ICT response and recovery plans to be tested, and major ICT-related incidents to be classified and reported on time — both are natural focuses for an exercise.
- FCA operational resilience requires scenario testing of important business services against severe but plausible disruption.
- Threat-led testing — a tabletop is not a TLPT, but it is an effective way to prepare a control team and rehearse decisions before one.
Tabletop exercise questions.
How long does a tabletop exercise take?
A single-group tabletop is often a half day. Combined exercises and live-play simulations may need a full day. Design typically takes a few weeks, depending on scope and participants.
Who should take part?
That depends on the objectives. Executive exercises usually involve the board or executive committee with legal, communications, compliance and risk. Technical exercises involve IT, security and incident responders. Key suppliers can be included.
Can you run it remotely?
Yes. Exercises can be facilitated remotely, in person, or as a hybrid.
How realistic are the scenarios?
Scenarios are threat-led — built from intelligence about actors and techniques relevant to your sector — and tailored to your systems, suppliers and important business services.
Is a tabletop exercise the same as a TLPT?
No. A tabletop is not a formal DORA TLPT or TIBER-EU test. It is, however, an effective way to test incident readiness and prepare for one.
Will participants be put on the spot?
Exercises are a safe environment to learn. We focus on the organisation’s plans, decisions and processes — not on individual performance.
Know the threat. Exercise the response.
Managed threat intelligence
Analyst-led cyber threat intelligence built on your priority intelligence requirements.
Learn moreDORA TLPT & TIBER-EU
Targeted threat intelligence for the intelligence phase of threat-led testing.
Learn morePenetration testing
Threat-informed testing of the paths attackers actually use.
Learn moreReady to test your response?
Tell us who should take part and what you want to rehearse.