Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How CISOs Use Tabletop Exercises to Stress Test Their Plans
Transcript
- Lucas: Luna, when was the last time you actually read your own incident response plan? Not the version that lives in a binder on a shelf, but the one you'd really use at three in the morning during a ransomware attack? Luna: Oof. I think we both know the honest answer is 'not recently.' And honestly, that's kind of the point of today's topic, isn't it? Lucas: Exactly. We're talking about tabletop exercises — the cybersecurity world's version of a fire drill. Not the kind where you just walk to the parking lot, but a structured, often stressful simulation where you walk through a realistic attack scenario in real time. Luna: And they sound great in theory. But I've been in a few that felt more like a PowerPoint reading than an actual test. So what separates a good exercise from a complete waste of an afternoon? Lucas: Let's start with a specific example. Imagine you're the CISO of a mid-sized healthcare company. It's a Tuesday morning, and your SOC gets an alert that a few endpoints are beaconing to an unknown domain. Within thirty minutes, the exercise inject says it's ransomware — files are being encrypted across two business units. Luna: Right, and so the immediate question is: who do you call first? The CEO? Legal? Or do you try to contain first and ask questions later? That's the kind of decision that gets tested. Lucas: And that's where most tabletop exercises go wrong. They're often scripted to a happy ending — the team follows the plan, the plan works, everyone feels good. But the real value comes when you inject chaos. A key server is unreachable. The backup administrator is on vacation. Your incident commander has to step out for a family emergency. Luna: So it's about testing the plan under duress, not just checking boxes. And that means the person running the exercise — the facilitator — has to be willing to play the adversary and be a bit of a jerk about it. Lucas: The good ones absolutely are. They call it a 'red team' mindset. And there's a growing trend of using ai generated injects to keep exercises unpredictable — not just the same old phishing email, but novel tactics that force the team to think on their feet. Luna: I've heard that some companies are even borrowing from the military's use of sand tables — you know, the miniature models they used to plan battles. It's a way to visualize the attack surface and the response in three dimensions. Lucas: That's a great analogy. A sand table forces you to think about terrain, logistics, and timing — and in cybersecurity, it's the same. You're not just talking about what you'd do, you're actually moving pieces around a map of your network. Luna: But before we get into the tactics, let's talk about why this actually matters. We've seen companies like MGM Resorts get hit with ransomware that took down their systems for days. Reports later showed they had gaps in their detection and response — gaps that a good tabletop might have exposed. Lucas: Right. MGM was a cautionary tale. The breach in 2023 disrupted hotel operations, casino floors, and even electronic room keys. And the irony is that they probably had an incident response plan. But a plan that isn't tested is just a hypothesis. Luna: So what does a truly effective tabletop look like? Is it a half-day session in a conference room with whiteboards and sticky notes? Lucas: Could be. But the best ones are multi-hour, sometimes multi-day events that involve not just the security team, but also legal, PR, HR, and even the board. Because a breach isn't just a technical problem — it's a business problem. Luna: And that's where communication becomes the bottleneck. I've seen exercises where the technical team knows exactly what to do, but they can't articulate it to the CEO in a way that helps them make a decision. Lucas: Exactly. That's why many CISOs now include a 'board room' inject — a simulated call where the team has to explain the situation to a pretend board of directors, who are asking tough questions about revenue impact, legal liability, and customer trust. Luna: So it's not just about technical chops. It's about leadership under pressure. And that's a skill you can't just read about in a manual — you have to practice it. Lucas: One thing that helps is using a 'purple team' approach — where red and blue teams work together during the exercise. The red team plays the attacker, but they're also sharing insights with the blue team so that everyone learns together. Luna: That sounds more productive than just a gotcha exercise. But I'm curious — what are the most common failure points you see in tabletop exercises? Lucas: Lack of realism is number one. If you're just reading from a script and never deviate, you're not testing anything. Number two is not involving the right people — if legal isn't in the room, you'll never know if your communication plan holds up. And number three is not following up. The exercise isn't the end; it's the beginning of a new cycle of improvement. Luna: And that's the point, right? You don't do a tabletop to feel good — you do it to find gaps. And then you fix them. It's like a stress test for your entire security posture. Lucas: Absolutely. And some companies are now using these exercises to also test their third-party incident response partners — you know, the firms they'd call in a real crisis. Luna: Smart. Because the last thing you want is to discover during an actual breach that your vendor's playbook doesn't match yours. Lucas: So here's a quick example of how a tabletop can expose something real. In a recent exercise I heard about, a retail company discovered that their backup strategy had a critical flaw: the backups were there, but the restoration process would have taken 72 hours, not the 24 they assumed. Luna: And that's a huge deal. Imagine telling your CEO that you'll be down for three days instead of one. That's the kind of finding that makes a tabletop worth every minute. Lucas: And it's not just about the technical stuff. It's about decision-making fatigue. In a real incident, you're making high-stakes decisions for hours or days on end. Tabletop exercises can help you build that muscle. Luna: So for CISOs listening — and for anyone who might be asked to participate in one — what's the one takeaway you'd want them to remember? Lucas: That a tabletop exercise is not a compliance checkbox. It's an investment in your ability to respond when it really matters. And the best time to find out your plan has holes is on a Tuesday afternoon, not at three in the morning during a real attack. Luna: And that's the kind of conversation that's worth having. Speaking of which — if you're finding value in these deep dives, and you want to help keep this show ad-free, you can support us at buy me a coffee dot com slash fexingo. It's a small gesture that makes a big difference for us. Lucas: Yeah, we really appreciate that. It keeps us going and lets us keep bringing you these practical insights. Now, back to the sand table — I want to get into how you actually plan one of these exercises. Luna: Yes, let's talk about the nuts and bolts. How do you even start planning a tabletop? Do you bring in an outside facilitator or keep it in-house? Lucas: There's a trade-off. An outside facilitator can be more objective and can play the adversary without internal politics. But they also need to learn your environment quickly. In-house teams know the landscape but might pull punches. Luna: So a hybrid approach might be best — maybe an outside firm to design the scenario, but with your own people facilitating parts of it. That way you get both perspectives. Lucas: Exactly. And you want to rotate participants. Don't always have the same people in the hot seat, because you never know who's going to be on call when a real incident hits. Luna: And for the CISOs listening, how often should you run these? Is it an annual thing, or more often? Lucas: At least annually, but more frequent for your critical teams. And make sure it's not always the same scenario. One year it's ransomware, the next it's a supply chain attack, the next it's an insider threat. Variety builds resilience. Luna: And what about after the exercise? What's the most important follow-up? Lucas: The after-action review. You need to document what worked, what didn't, and what you're going to change. And then you have to actually make those changes — otherwise you just had a very expensive conversation. Luna: It's like they say: practice doesn't make perfect. Perfect practice makes perfect. And tabletop exercises are the perfect practice for when things go wrong. Lucas: Well said. And I think that's a great place to leave it. For us, the reminder is simple: test your plans, involve everyone, and learn from every drill. Because when the real thing comes, you'll be glad you did.