TabletopExercise

TabletopExercise Skill

Purpose

Design, facilitate, and evaluate cybersecurity tabletop exercises (TTX) for technical and executive audiences. Generate realistic scenarios, technical atomics for runners, and identify organizational gaps in incident response capabilities.

When to Use

• Designing tabletop exercise scenarios for SOC teams or executives
• Creating technical "atomics" (executable injects) for scenario runners
• Generating checklists to identify missing SOPs, playbooks, or procedures
• Evaluating incident response plan effectiveness
• Building cross-functional coordination exercises
• Post-exercise gap analysis and improvement planning

Key Capabilities

1. Scenario Generation

• Executive Scenarios: Business impact focus, decision-making, communication strategies
• Technical Scenarios: Detailed detection/response, forensics, technical challenges
• Hybrid Scenarios: Cross-functional coordination exercises
• AI-Enhanced: Deepfake attacks, automated threat chains, supply chain compromise

2. Technical Atomics for Runners

Exercise facilitators receive executable atomics - specific technical actions to simulate during scenarios:

Example Atomic Set (Ransomware Scenario):

T+0min: Send initial phishing email to participant's test inbox
T+15min: Simulate EDR alert: "Suspicious PowerShell execution on DESKTOP-01"
T+30min: Inject: Backup system shows "Replication failed - destination unreachable"
T+45min: Deliver ransom note via simulated file share
T+60min: Simulate CEO email inquiry: "Why can't I access the sales database?"

3. SOP/Playbook Gap Analysis

Automatically generates checklists identifying missing procedures:

Example Output:

MISSING PLAYBOOKS IDENTIFIED:
□ Ransomware Response Playbook
  - Detected mentions of: encryption, ransom, backup restoration
  - No documented procedure found for: crypto-ransomware containment

□ Executive Communication Protocol
  - Scenario requires CEO notification
  - Missing: Executive notification checklist, approval thresholds

□ Vendor Breach Response
  - Third-party compromise scenario element present
  - Missing: Vendor incident coordination runbook