Tabletop Exercise
Definition
A structured, discussion-based simulation in which team members walk through a hypothetical incident using the playbook as a guide, without touching live systems. Used to test playbook logic, identify gaps, and build team familiarity.
- Format
- Discussion-based simulation, no live systems touched
- Basis
- Walks through a hypothetical incident using the playbook
- Purpose
- Test playbook logic, find gaps, build team familiarity
- Field
- Incident response planning
Common questions
How does a tabletop exercise differ from a live-fire or red-team simulation?+
A tabletop exercise is purely discussion-based, participants talk through decisions and actions against a hypothetical scenario without touching any live system, whereas a live-fire exercise or red-team engagement involves actual technical actions against real or test infrastructure, making tabletop exercises lower cost and lower risk but less revealing of technical gaps.
What kind of playbook gaps does a tabletop exercise typically reveal?+
Common findings include unclear escalation ownership, missing contact information, ambiguous decision criteria for declaring an incident, and steps that assume access or authority a responder does not actually have, all of which surface naturally when participants try to follow the playbook aloud.
How often should an organisation run tabletop exercises for its incident response playbook?+
There is no single mandated interval; most incident response programs run them at least annually or after significant infrastructure or team changes, with more mature programs running them more frequently against varied scenario types to keep the playbook and team readiness current.
Related terms
- Decision Gate
- A checkpoint within a playbook at which the responder must evaluate a condition, such as whether data exfiltration has been confirmed, and...
- Indicators of Compromise (IoCs)
- Artefacts observed on a network or system that suggest an intrusion or malicious activity has occurred, such as unusual outbound connections, known-malicious...
- Playbook
- A documented step-by-step procedure for responding to a specific type of security event. Playbooks standardise analyst behaviour, reduce response time, and ensure...
- Runbook
- A technical execution document, sometimes used interchangeably with playbook but more precisely refers to the low-level commands and scripts used during a...
- SOAR
- Security Orchestration, Automation and Response. A platform that can execute playbook steps automatically, such as blocking an IP address or disabling a...