When You Can't Break Production
Some disasters can't be safely simulated in a live system. You cannot stage a realistic ransomware attack against your production environment to see how Legal responds. You cannot simulate a data breach to test your PR team's messaging. For these high-stakes, cross-functional, or legally sensitive scenarios, we use Tabletop Exercises (TTX).
A TTX is a discussion-based session where participants talk through a hypothetical disaster scenario step by step — no keyboards, no actual systems affected. Think of it as a structured role-playing exercise where the goal is to surface gaps in decision-making authority, communication chains, and cross-team coordination.
Who Is It For?
GameDays are primarily for engineering teams. TTXs are designed for the broader organization, especially people who would never join an incident bridge:
- Executives: CEO, CTO, CFO — who makes the call to pay a ransom? Who authorizes taking the site offline?
- Legal and Compliance: When must regulators be notified? What can and cannot be said publicly?
- Communications and PR: Who drafts the customer notification? Who approves it? What's the timeline?
- HR: What happens if the incident involves an insider threat?
How a TTX Runs
The facilitator presents a scenario in injects — discrete narrative updates that advance the story and force decisions.
Example: The Ransomware TTX
| Time | Inject | Key Question Forced |
|---|---|---|
| T+0 | "It is 9:00 AM Monday. Your SIEM alerts on unusual file encryption activity across 40% of your file servers." | Who declares an incident? Who gets called first? |
| T+30 min | "The attacker has sent an email to the CEO's personal address demanding $5M in Bitcoin within 48 hours." | Do you pay? Who decides? Do you call the FBI? |
| T+1 hr | "A journalist from a major tech publication is calling the CEO's cell phone." | Who speaks to press? What is the approved statement? |
| T+2 hr | "Your legal team confirms customer PII may be affected. GDPR requires notification within 72 hours." | Who drafts the notification? Who approves it? |
After each inject, the facilitator pauses and asks the room: "What do you do right now, and who is responsible?" The gaps that surface — "I assumed Legal would handle that," "I didn't know we had a 72-hour obligation" — are the findings.
Goal: To clarify decision-making authority and communication paths before a crisis hits, when there is no time to figure out who is in charge.
Key Point: TTXs are particularly valuable for revealing assumption gaps — situations where two people each assume the other is responsible for a critical action. In a real incident, assumption gaps become dropped balls. A TTX makes them visible in a low-stakes environment.