Executive tabletop
For boards and senior leaders. Focus on decision authority, customer and regulator communications, third-party dependencies and strategic trade-offs.
← Threat HubRehearse the decisions
THREAT HUB / TABLETOP EXERCISES
Rehearse the decisions
that matter.
Facilitated cyber exercises built around credible threats to your organisation. Test escalation, coordination and response, then turn what you learn into clear actions.
The exercise
Practise the decisions an incident would demand.
A tabletop gives decision-makers a safe setting to test how they would handle a credible cyber incident. We build the scenario around your services, dependencies and relevant threats, then introduce developments that force choices about escalation, containment, communications and recovery.
The value is in the record of what happened: who decided, what information was missing, which handoffs worked and what needs to change.
Formats
Choose the people and pressure points.
Technical tabletop
For incident response, security and operations teams. Walk through detection, triage, containment, evidence, recovery and out-of-hours assumptions.
Combined exercise
Connect executive and technical teams. Test the handoffs between what responders know and what leaders need to decide.
Live-play simulation
Use timed injects and changing information to create a more demanding rehearsal of coordination and crisis response.
Method and outputs
A clear record of readiness and gaps.
We agree exercise objectives and scoring criteria before delivery. The facilitator observes what participants actually do and debriefs the group while the decisions are fresh.
Exercise package
- Scoping workshop and participant plan
- Threat-informed scenario and timed injects
- Facilitated session, remote or in person
- Observation against agreed criteria
- Written findings and prioritised actions
- Owners and a route to follow-up exercise
Example scenario
A supplier incident reaches a critical service.
A trusted provider reports suspicious access. What do you know, and who can confirm it?
A customer-facing service becomes unavailable. Who can authorise containment and how do you communicate impact?
New evidence suggests data may have moved. Which legal, regulatory and customer decisions now need owners?
This is an illustrative scenario. The real exercise is built around your systems, plans and objectives.
Frequently asked questions
Before we begin.
How long does a tabletop take?
A single-group exercise is often a half day; a combined or live-play format may need a full day. Preparation and reporting are scoped separately.
Who should attend?
The people who would make or support the decisions in the real incident. We agree roles and group size during scoping.
Can you use a scenario from our threat intelligence work?
Yes. A targeted threat scenario can be adapted into an exercise, with the right controls around any live or confidential test information.
Does a tabletop count as a formal TLPT?
No. A tabletop tests decisions and coordination. A formal threat-led penetration test follows its own framework, roles, live testing and authority process.
Talk to SMARTSEC
Start with your objective.
Tell us the decisions, test or exercise this work needs to support. We'll suggest a scope and the right next step.