Loading story…
Tabletop exercises have become a critical component of incident response (IR) planning, enabling organizations to prepare for cyber incidents in a controlled, discussion-based environment. These exercises simulate hypothetical security incidents, allowing teams to practice their response strategies without the pressure of a real-world attack. The primary objective is to validate and improve existing IR plans, ensuring that all stakeholders understand their roles and responsibilities. Tabletop exercises typically involve key personnel from various departments, including leadership, security, legal, and compliance, to foster cross-functional collaboration and communication. Unlike technical drills such as penetration tests, tabletop exercises focus on decision-making processes, coordination, and the identification of potential gaps in response protocols. Common scenarios used in these exercises include ransomware attacks, business email compromise, insider threats, distributed denial-of-service (DDoS) attacks, supply chain breaches, and data breaches. Effective tabletop exercises are tailored to the specific risk profile, business objectives, and industry context of the organization, ensuring relevance and actionable outcomes. The exercises are often facilitated by a designated leader, such as a TTX Master, who guides the discussion and ensures the scenario remains on track. Roles such as Incident Commander and Incident Deputy are assigned to simulate real-world responsibilities during an incident. Regularly conducting tabletop exercises, rather than treating them as a mere compliance checkbox, helps organizations build muscle memory and confidence in their response capabilities. These exercises also provide an opportunity to identify weaknesses in current plans, improve communication channels, and refine escalation procedures. By practicing in a low-stress environment, teams can better prepare for the emotional and operational challenges of an actual incident. Organizations are encouraged to run tabletop exercises as frequently as needed to maintain readiness, rather than adhering to a minimal annual schedule. The ultimate goal is to enhance organizational resilience, reduce response times, and minimize the impact of cyber incidents through continuous improvement of incident response strategies.
Get the actors, campaigns, and ATT&CK mapping behind it.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security leaders are increasingly recognizing that traditional approaches to cybersecurity training and incident response are insufficient in the face of rapidly evolving threats. According to the Cytactic 2025 State of Cyber Incident Response Management (CIRM) Report, 57% of significant cyber incidents involve attack scenarios that organizations have never rehearsed, highlighting a critical gap in preparedness. Many organizations focus their tabletop exercises on well-known threats such as ransomware, but the real challenge often comes from novel and unexpected attack vectors. Security experts argue that tabletop exercises are frequently either too specific or too grandiose, failing to address the nuanced and likely scenarios that teams are more apt to encounter. For example, some enterprises have gone to great lengths, such as purchasing burner phones for secure communications during exercises, only to discover practical issues during the simulation. Analysts and consultants point out that these exercises often lack realism and do not align with the actual risk and threat profiles of the organization. Meanwhile, a global survey by DarkTrace found that 74% of cybersecurity professionals view AI-powered threats as a major challenge, and 90% expect these threats to significantly impact their organizations within the next one to two years. The increasing use of AI-generated malware and autonomous reconnaissance by adversaries means that threats are evolving in real time, outpacing the static, compliance-driven training models many organizations still use. Legacy approaches, such as annual penetration tests and semi-annual tabletop exercises, are no longer adequate, as they provide limited visibility and fail to build lasting strategic capabilities. These outdated models also assume that adversaries are predictable, which is no longer the case in the current threat landscape. Experts advocate for a shift toward Continuous Threat Exposure Management (CTEM), a discipline that emphasizes ongoing, threat-informed practice rather than occasional, fragmented exercises. This approach requires organizations to move from reactive defense to operational resilience, fostering cross-functional collaboration and daily engagement with emerging threats. By making training exercises more relevant, realistic, and tailored to the organization's specific context, security teams can better align with business objectives and improve their ability to respond to unforeseen incidents. The consensus among industry leaders is that a transformation in both mindset and practice is essential to keep pace with the dynamic nature of cyber threats. Organizations that fail to adapt risk being unprepared for the next wave of sophisticated attacks, particularly those leveraging artificial intelligence and automation. Ultimately, the future of cybersecurity training lies in continuous, adaptive, and business-aligned preparation that mirrors the complexity and speed of modern adversaries.
Jun 29, 2026
Effective incident management is a critical component of operational security for organizations of all sizes, enabling them to respond to and recover from cybersecurity incidents with minimal disruption. Executive leaders, particularly those aligned with CISSP principles, are encouraged to view incident management not just as a technical necessity but as a strategic enabler that minimizes business disruption, limits financial and reputational losses, and ensures regulatory compliance. The incident management lifecycle encompasses preparation, detection and analysis, containment, eradication, and recovery, with a strong emphasis on readiness and continuous improvement. Preparation involves establishing and training an incident response team, developing integrated response plans, maintaining updated asset inventories, and pre-arranging contracts with digital forensics and legal experts. Early detection is facilitated by monitoring systems such as SIEM, IDS/IPS, and EDR, and relies on clear definitions of security incidents and tiered severity classifications. Impact assessments and stakeholder communications are key outputs of the detection and analysis phase. Containment and eradication require swift action to isolate affected systems and remove threats, while recovery focuses on restoring operations and learning from the incident to improve future responses. In parallel, workforce training is essential to ensure that staff are equipped to handle the most common cyber threats. Research from Cleveland State University demonstrates that even organizations with limited resources, such as SMBs, can benefit from a streamlined approach to the NICE Cybersecurity Workforce Framework. By focusing on the most prevalent threats—phishing, malware, ransomware, and web-based attacks—training can be made more practical and relevant. Scenario-based curricula, which simulate real-world attacks like ransomware delivered via EternalBlue or PBX hacking, help learners develop both technical and legal response skills. These exercises are supported by virtual machine labs and legal case studies, ensuring that participants understand both the technical and regulatory aspects of incident response. The research highlights that a focused, scenario-driven training approach can be effective for organizations of any size, providing a model for larger enterprises to enhance their own incident management capabilities. By integrating technical skills with legal and regulatory knowledge, organizations can build resilient teams capable of responding to evolving cyber threats. Continuous learning and adaptation are emphasized as key to maintaining security maturity and operational continuity. The combination of robust incident management processes and targeted workforce training forms the foundation of a resilient cybersecurity posture for modern enterprises. Executive leaders are advised to invest in both strategic planning and practical training to ensure comprehensive preparedness for cybersecurity incidents. The integration of legal, technical, and operational considerations is essential for effective incident response and long-term organizational resilience. Ultimately, organizations that prioritize both incident management and workforce development are better positioned to navigate the complexities of today’s threat landscape.
Jul 12, 2026
A new industry report reveals a significant gap between organizational confidence and actual cyber readiness, with most security teams overestimating their ability to handle major incidents. Despite 91-94% of leaders expressing confidence in their incident response capabilities, measurable resilience scores have not improved since 2023, according to Immersive's Cyber Workforce Benchmark Report 2025. The report, based on data from 1.8 million exercises and a survey of 500 cybersecurity leaders, highlights that teams average only 22% decision accuracy in crisis simulations and require over 29 hours to contain simulated attacks. Median completion times for essential hands-on labs remain at 17 days, and more than 60% of organizations are training on vulnerabilities that are over two years old, leaving them unprepared for current threats. The report attributes this stagnation to narrow training scopes, with only 41% of organizations involving nontechnical roles in simulations, and a focus on outdated vulnerabilities. Immersive recommends that organizations diversify and increase the frequency of their simulations, ensure exercises are fully completed, directly engage senior leadership, expand participation beyond IT, and prioritize training on current CVEs. The findings underscore the need for organizations to shift from a checkbox approach to readiness toward building real, practiced coordination under pressure to improve cyber resilience.
Jun 29, 2026