CLICK HERE TO DOWNLOAD THIS IMAGE & COLOR IT IN!Every great adventure begins with a single step. For kingdoms looking to fortify their cyber resilience, that first step is the annual cybersecurity tabletop exercise. But is one grand quest per year enough to turn a fledgling incident response program into a battle-hardened fellowship?
In this CISO’s humble opinion, the answer is a resounding “no.” To truly level up your incident response capabilities, you need to forge a modern tabletop exercise program. That means venturing beyond the annual TTX, and embarking on regular quests that prepare your party for the evolving dangers of the cyberscape.
Each TTX should challenge different elements of your incident response capabilities, uncovering weaknesses and sharpening the party's skills along the way. In this guide, we'll explore how to build a repeatable TTX program that upgrades your team's readiness with every adventure.
An annual tabletop quest can reveal a few weaknesses and provide your party with a handful of skill points, but consistent level ups require regular incident response training. When adventuring becomes consistent, party members can apply lessons learned from one TTX in the quest that follows.
When a kingdom first begins to dabble in tabletop exercises, a common blunder is thinking that the “one (annual) TTX to rule them all” style of approach will yield potent results. The yearly TTX draws a valuable baseline for your party's incident response capabilities, but the path to preparedness is a long one. Meaningful progress requires more frequent cybersecurity training.
That being said, it’s not realistic to expect all party members to participate in a new TTX quest every other week. Consider a tiered approach that gives different guilds opportunities to hone their unique abilities at customized cadences:
This allows you to deliver consistent training across all corners of the realm, without overburdening a single guild. For smaller kingdoms, combining technical and business objectives into a single exercise (or alternating the focus each month) can provide a more manageable path forward. The goal is to construct a sustainable rhythm that keeps muscle memory sharp throughout the year.
Hyper-personalization and relevancy are two of the primary ingredients for a potent TTX program. These can be achieved by drafting scenarios based on shifts to a kingdom’s threat landscape, or by drawing power from a recent organizational change. Updates to the incident response plan, the addition of new party members, evolving compliance requirements, and findings from previous exercises make for great scenario seeds.
If an imminent threat appears on the horizon without warning, there's no need to wait until your next scheduled quest to prepare for battle. Significant changes to a kingdom’s threat landscape may warrant an additional TTX (or a bump to an earlier date for one that’s scheduled) to test the party's readiness against the new adversary.
At the core of every TTX lies an important question: What are we testing? The answer should determine the scope of your tabletop. Tighter, more focused quests can provide just as much value as massive ones.
Rather than attempting to conquer your entire incident response plan in a single shot, consider running tighter, 60-90-minute TTXs that test just a handful of meaningful objectives. These bite-sized quests allow your party to identify a handful of weaknesses, develop specific skills, and make incremental improvements without feeling overwhelmed. If you want to infuse an extra layer of team-building, try having different party members facilitate exercises based on their subject matter expertise.
As your fellowship gains experience, gradually raise the stakes. Begin with focused technical encounters, progress to cross-functional campaigns, and eventually assemble the kingdom's leaders for a grand executive crisis exercise. Each quest builds upon the last, preparing your party for increasingly formidable journeys.
Each tabletop should challenge different skills and give various members of the kingdom a chance to prove their mettle. Let’s explore how to keep TTX campaigns fresh while keeping the bigger picture in mind.
Great tabletops are rooted in well-defined objectives. Whether your party is tasked with containment during a cyber siege, sounding the alarm bells, or ensuring business continuity amidst chaos, each adventure should be built around a specific goal or skillset.
To ensure the lessons stick, don't make your TTX a trivia contest about the kingdom's incident response plan. Instead, challenge your party to put that knowledge into action. Can they locate the right procedures, identify who's calling the shots, escalate appropriately, and carry out their duties when danger strikes?
When deciding which quest to embark on next, consult the records and findings from adventures past. Peruse these previous TTXs alongside security assessments and real-world incidents. These can reveal which capabilities need an upgrade, and what threat to face off against in the next campaign.
A fearsome fellowship demands more than InfoSec warriors on the front lines. IT wizards, Legal scouts, HR healers, and other specialists all bring unique abilities to your kingdom’s cybersecurity incident response team.
When assembling your party for a TTX, summon the guilds whose skills and decision-making authority are best suited to the quest at hand. As highlighted previously, technical encounters may only call for InfoSec and IT, while larger campaigns may require reinforcements from Legal, PR, HR, Finance, and other corners of the realm.
Let the kingdom's leaders take command during executive quests, with technical teams serving as trusted advisors. And don't forget the unsung heroes! Procurement, business continuity teams, application owners, and critical service providers may prove invaluable when disaster strikes.
The cyberscape is crawling with formidable foes, from ransomware-wielding goblins to cunning identity thieves. How do you decide which monster deserves a place in your next TTX campaign?
Most quests should pit your party against threats currently relevant to your kingdom's unique risk landscape. Rotate between scenarios involving threats and incidents like identity compromise, cloud outages, insider threats, supply chain attacks, and disaster recovery to keep your fellowship battle-ready for a variety of adversaries.
Of course, even the wisest wizard can't predict every danger lurking within the fog of war. It’s good to occasionally venture into uncharted territory by testing emerging threats, provided they pose a plausible risk to your kingdom and have a meaningful capability to test. Aside from providing valuable insight, a little unexpected danger can make your TTX more engaging (and fun)!
The organizations that practice for emerging threats will be far better positioned to absorb those shifts without having to reinvent their response capabilities in the middle of a crisis. — Roger Grimes, Founder at Post-Quantum Defense
While a containment-based TTX may reveal vulnerabilities in the castle walls, a ransomware recovery exercise may expose an unguarded passage beneath the fortress. By testing different aspects of your incident response process, you can uncover weaknesses in all corners of the kingdom.
For example, start a ransomware scenario after the enemy has already breached the gates and seized control of critical systems. Rather than focusing on repelling the invaders, you can test the disaster recovery plan by challenging your party to revive a vital business service.
This quest may reveal dangers that a traditional containment exercise overlooks. Perhaps recovery depends on compromised identity systems, or the kingdom's backup administrators lack emergency access credentials. These hidden weaknesses could prevent your party from meeting its recovery time objectives (RTOs), the target timeframes for restoring critical services. Better to discover these weaknesses during a TTX than while a dragon is attacking!
Your fellowship has ventured into the unknown, faced formidable foes, and uncovered real gaps in the IRP. But how do you know whether the party is actually growing stronger? A successful TTX program isn't measured by the number of quests completed, but by the upgrades made along the way.
A legendary adventurer keeps a tidy quest log, and a great TTX Facilitator should be no different. Whenever your fellowship uncovers weaknesses in the kingdom's defenses, scribe those findings and assign a corrective side quest to a party member. Be sure to include a clear objective and a deadline. If you need a hand chronicling everything, summon Asa (Ally's built-in scribe assistant) for aid!
Use your risk register or existing ticketing system to track these quests. This will help to ensure that no critical objectives get buried beneath a mountain of unfinished scrolls. After all, identifying a vulnerability is only half the battle. True victory comes when the weakness is fixed.
Revisit important findings in future TTXs to confirm that your party's upgrades actually work. There's no need to retrace your steps immediately in the next scheduled campaign. Let a few more adventures pass, then re-test past fixes to confirm that no gaps have been resurrected.
The gaps you uncover through cybersecurity tabletop exercises become opportunities to bolster the kingdom’s defenses. By putting those newfound strengths to the test in future encounters, you establish what we refer to as the “virtuous cycle of cyber preparedness.”
Exercise → Finding → Corrective Action → Re-test
As your fellowship embarks on more adventures, review the quest logs from each. Deciphering trends or recurring patterns can reveal whether your incident response capabilities are truly leveling up. To measure your party's progress, consider tracking these KPIs:
Any adventurer can claim to wield a sword, but can they actually swing it when a band of orcs comes knocking? Occasionally going beyond discussion and challenging party members to actively demonstrate their abilities can reveal whether their skills would hold up beyond the tabletop.
During a TTX, try asking the party to perform a small, practical task. This could be as simple as retrieving a contract from the castle archives, or as involved as demonstrating emergency access procedures in a safe test environment. Practical, hands-on challenges like these can add another layer of insight and engagement to incident response team training.
A mature TTX program adapts to the kingdom's evolving risks, challenges members of different guilds across exercises, and uses lessons from past campaigns to chart the path forward. As your party completes quests and closes gaps, its members should become more decisive and coordinated.
After a handful of adventures, your party’s warriors now know when to draw their swords, the scouts can spot danger on the horizon, and the healers know exactly who needs aid. What was once a band of fledgling adventurers has become a battle-hardened fellowship. By going beyond the annual TTX quest, the party is ready to face whatever lurks beyond the next mountain.
Ally equips Facilitators with the instruments to build, run, and report on recurring tabletop exercises. Craft TTXs in a flash, ditch PowerPoint with our engaging delivery platform, and conjure After-Action Reports in minutes. From running your first TTX to showing how preparedness improves from one encounter to the next, Ally helps keep the campaign moving.
Ready to venture forth and go beyond the annual TTX quest? Sign up for Ally and start your next adventure!
Organizations should conduct cybersecurity tabletop exercises regularly, with frequency determined by the teams and capabilities being tested. A tiered approach might include monthly technical exercises, quarterly cross-functional exercises, and annual executive exercises. Smaller organizations can combine objectives or alternate their focus to establish a sustainable cadence.
Build an effective tabletop exercise program by establishing a recurring schedule, defining measurable objectives, and tailoring scenarios to relevant organizational risks. Vary participants and capabilities across exercises, document findings, assign corrective actions, and retest improvements. Each exercise should contribute to a continuous cycle of incident response improvement.
Cybersecurity tabletop exercises should test critical incident response capabilities, including investigation, containment, escalation, communications, decision-making, business continuity, and disaster recovery. Scenarios should reflect realistic organizational risks, with occasional exercises exploring emerging threats. Focus each exercise on a manageable set of objectives to uncover actionable weaknesses.
Tabletop exercise participants should include stakeholders responsible for responding to or making decisions during the simulated incident. Depending on the scenario, this may include InfoSec, IT, Legal, HR, Finance, PR, executives, business continuity teams, and third-party providers. Participants should rotate based on the capabilities and decisions being tested.
Measure tabletop exercise effectiveness by tracking incident escalation times, decision-making speed, corrective-action completion, recurring weaknesses, and recovery readiness. Compare findings across exercises to identify improvements in team coordination, decision-making authority, and response capabilities. Retesting corrective actions helps validate whether identified weaknesses have been resolved.
Will McGuire is Head of Cybersecurity and CISO at ICEYE US, bringing over 15 years of experience in cybersecurity strategy, governance, and operations. They are also co-founder and President of Cannon Fodder Security, a nonprofit supporting the cybersecurity community.
Read more
About Ally Security
Ally is here to support TTX Facilitators in creating a virtuous cycle where exercises run more swiftly and frequently, deliver greater value, and bring organizations closer to true preparedness.
Dear Asa is your anonymous scroll to share triumphs, tribulations, and “you had to be there” moments. No names. No judgement. Just true incident response tales forged in the heat of battle.
