How long should an executive tabletop exercise be?

Ninety minutes to two hours is the practical range for an executive or board tabletop. Senior diaries rarely allow more, and attention drops once the key decisions have been made. Keep the scenario to four to six injects, send a short pre-read in advance, and reserve at least 20 minutes at the end for a hotwash focused on decisions and follow-up actions.

Who should attend an executive cyber tabletop exercise?

The people who would actually make the calls in a crisis: the CEO, CFO, COO, general counsel, head of communications and the CISO or CIO. Add the head of the most affected business unit and, if relevant, HR and the risk or compliance lead. Board members can play themselves or observe. Keep the group under a dozen so every voice is heard.

What is the difference between an executive and a technical tabletop exercise?

A technical tabletop tests detection, containment and recovery procedures, and the discussion is about tools, logs and runbooks. An executive tabletop tests decisions: whether to shut down revenue-generating systems, how to handle a ransom demand, when an incident is material, who speaks publicly and when to call the insurer and outside counsel. Technical detail is summarised, not debated.

Should the board take part in a cyber tabletop exercise?

It is increasingly common and often worthwhile. Boards oversee cyber risk and some regimes, such as NIS2 in the EU, place explicit responsibilities on management bodies. A board session can be a shorter version of the executive exercise, or board members can observe the executive team and then discuss oversight questions: escalation thresholds, disclosure and risk appetite.

Executive Tabletop Exercise: A Guide for Boards and C-Suite

An executive tabletop exercise is a facilitated, discussion-based rehearsal of a cyber crisis for the leadership team or board. Instead of testing tools and runbooks, it tests the decisions only senior leaders can make: whether to take revenue systems offline, how to respond to extortion, when an incident becomes material, and who speaks for the organisation.

It is shorter, tighter and more focused than a technical exercise. Ninety minutes to two hours, four to six injects, a one-page pre-read and a facilitator who keeps the room on decisions rather than on the mechanics of malware. This guide covers how to design one, which decisions to force, how to handle a room full of senior people and how to report the results to the board.

How executive exercises differ from technical ones

The general method is the same as any tabletop exercise: objectives first, a realistic scenario, staged injects, a hotwash and an improvement plan. What changes is the altitude.

	Technical tabletop	Executive tabletop
Focus	Detection, containment, eradication, recovery steps	Business decisions, authority, disclosure, reputation
Typical duration	2–4 hours	90–120 minutes
Number of injects	8–12	4–6
Participants	IR lead, SOC, IT ops, cloud, application owners	CEO, CFO, COO, general counsel, comms, CISO/CIO
Preparation for players	Plans and playbooks to hand	One-page pre-read sent a week ahead
Technical detail	Debated in depth	Summarised by one briefer in plain language
Key outputs	Procedure gaps, tooling gaps	Decision rights, thresholds, pre-agreed positions

Two things follow from this. First, fewer injects: each one must land on a decision, and anything that only tests operational detail belongs in a separate exercise. Second, the pre-read matters. Executives who arrive knowing the objectives, their role and the crisis structure spend the session deciding instead of orienting.

A good pre-read fits on one page: the purpose of the exercise, three to five objectives, the ground rules (no-fault, not an audit of individuals), who plays which role, and a short reminder of how the crisis team is convened. Do not include the scenario.

The decisions to force

An executive exercise earns its time by putting uncomfortable, pre-emptable decisions on the table. Pick three or four of the following and design an inject around each.

Shutting down revenue

The single most valuable executive decision to rehearse. The technical team says containment requires taking the e-commerce platform, the plant network or the customer portal offline for an unknown period. Who can authorise it? What is the cost per hour, and does anyone in the room know? What is the threshold at which the CEO must be consulted, and what happens if they cannot be reached? The answer should be written into the plan, not improvised.

Ransom and extortion governance

Whether or not the organisation would ever pay, leaders should know how the decision would be made. Who is in the decision group? What role do the insurer, outside counsel and law enforcement play? Who checks sanctions exposure? Is there a board-approved position, and does it survive contact with a scenario where backups have failed? The ransomware scenario is built to reach this decision point.

Disclosure and materiality

For listed companies, this is often the sharpest decision in the room. US public companies must disclose a material cybersecurity incident on Form 8-K Item 1.05 within four business days of determining that it is material, so the process for making that determination needs an owner and a record. In the EU, NIS2 sets staged reporting for significant incidents (an early warning within 24 hours, a notification within 72 hours and a final report within a month), and GDPR requires notifying the supervisory authority of a personal-data breach within 72 hours of awareness where feasible. The exercise should test who decides, on what evidence, and how the decision is documented. The data breach notification scenario is a good vehicle for this.

Who speaks publicly

Journalists call the switchboard; a customer posts on social media; a large client's CISO emails the CEO directly. Who is the spokesperson? Does the CEO speak or stay back? What can be said before facts are confirmed? How are employees told, and who approves statements across legal, communications and the executive team?

Insurer, counsel and external support

Many cyber policies require early notification and the use of panel providers. Executives often assume someone else has called the insurer. Ask directly: who calls, when, and with what information? Is outside counsel engaged early enough to preserve privilege over the forensic work, where that applies in your jurisdiction?

Impersonation of leaders

Modern scenarios increasingly target executives themselves. A cloned voice of the CEO instructs finance to make an urgent payment, or a fake video circulates. The deepfake CEO fraud scenario tests verification procedures and how leaders prove their identity to their own staff.

Briefing the technical context without jargon

Executives do not need to understand lateral movement or domain controllers. They need to understand consequences, uncertainty and options. Assign one technical briefer, usually the CISO or IR lead, and coach them to present each update in the same shape:

What we know. Plain facts. "Payroll and email are down at three sites."
What we don't know yet. "We don't know if customer data left the network. We'll have a first view in about six hours."
What it means for the business. "Orders can still be taken by phone; nothing ships until the warehouse system is back."
Options and what we recommend. "Option A keeps the platform online and risks further spread. Option B takes it down for an estimated 24–48 hours. We recommend B."
The decision we need from you, and by when.

Ban acronyms that the CFO would not use in a board paper. If a term must be used, translate it once: "The attacker has administrator access, which means they can switch off our defences and delete backups."

Give executives uncertainty on purpose. Real crises never offer complete information, and the most useful thing an executive exercise can show is how leaders decide when the technical team says "we don't know yet".

Facilitating a senior room

Facilitating executives is different from facilitating engineers. The facilitation guide covers the fundamentals; senior rooms add a few specific challenges.

Seniority dynamics. Once the CEO states a view, discussion often stops. Ask other roles to speak first on each decision, or go round the table before inviting the most senior person. A simple framing helps: "Before we hear the CEO's call, what would each of you need to know to support it?"

Candour. Leaders are rarely comfortable saying "I don't know" in front of peers. Say explicitly at the start that the goal is to find gaps, that the exercise evaluates plans and not individuals, and that the notes will not attribute comments to named people. Then honour it in the report.

Delegation reflex. Executives will often say "the IT team would handle that". Accept it, then push back up: "Suppose they have. They now need a decision from this table. What is it?"

Time. Senior participants arrive late and leave early. Start with the most important decision, not a slow warm-up, and have a shortened path ready if the room loses half an hour.

Who facilitates. An external facilitator or a respected internal leader from outside the reporting line makes it easier to challenge the CEO. The CISO should usually play their real role rather than facilitate.

A sample 2-hour executive agenda

This agenda assumes a ransomware-with-data-theft scenario and around ten participants.

Time	Segment	What happens	Decision forced
0:00	Welcome and ground rules	Purpose, no-fault rules, roles confirmed	—
0:10	Situation briefing	CISO briefs the starting situation using the five-part format	Is this a crisis? Convene the crisis team?
0:20	Inject 1: Operations down	Core system encrypted; containment requires taking a revenue platform offline	Authorise shutdown; accept estimated cost
0:40	Inject 2: Extortion	Ransom demand with proof of stolen data and a deadline	Engage insurer and counsel; ransom governance
1:00	Inject 3: Disclosure pressure	Regulator deadline approaching; forensic picture still incomplete	Materiality and notification decisions; who records them
1:20	Inject 4: Public exposure	Journalist has the leak-site post; a key client demands answers	Spokesperson, holding statement, client outreach
1:35	Hotwash	What worked, what did not, three to five improvement actions	Owners and dates for each action
1:55	Close	Sponsor summarises commitments	—

If you have more time, add a short fifth inject that jumps the clock forward two weeks and asks about recovery priorities and board reporting. If you have less, merge injects 3 and 4.

The scenario library has scenarios you can shorten for an executive session. You can also run one live with the exercise runner: the facilitator releases injects to participants' phones, decisions are captured as they are made, and the after-action report can be exported at the end, which saves the scribe from reconstructing who decided what.

Running a board session

Boards can take part in two ways. They can play themselves in a shortened version of the scenario, focused on the questions a board would actually receive: "Management recommends paying; do you support it?" or "Management has determined the incident is not material; are you satisfied with the basis?" Alternatively, board members observe the executive exercise and hold a separate discussion afterwards on oversight: escalation thresholds, what they expect to be told and when, and whether the risk appetite statement covers the scenario.

Under NIS2, management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for failures, and are required to follow training. A documented board exercise is one practical way to show that oversight is active rather than nominal.

Reporting results to the board

Senior participants want the outcome, not the transcript. Keep the board report to two pages and structure it around decisions:

Purpose and scope. One paragraph: scenario, date, who took part, objectives.
What worked. Two or three strengths, stated specifically.
Decision gaps. Each decision the exercise forced, whether the team reached it, how long it took in exercise time, and whether authority and criteria were clear.
Improvement actions. A short table with the action, owner, due date and the risk it addresses.
Next exercise. When the gaps will be retested.

Decision	Reached?	Authority clear?	Gap	Action	Owner	Due
Take the order platform offline	Yes, after long debate	No	No documented threshold for revenue shutdown	Add shutdown authority and cost thresholds to crisis plan	COO	60 days
Materiality determination	Partly	Partly	No named owner for the record of the determination	Assign owner; create disclosure decision log template	General counsel	30 days
Notify insurer	No	No	Each function assumed another had called	Add insurer notification to the first-hour checklist	CFO	14 days

Avoid scores for individuals and avoid a single overall grade. The after-action report guide covers the full format. Rate capabilities and plans, never people, or the next session will be less candid.

Common mistakes with executive exercises

Too much technical detail. If the discussion drifts into which EDR tool flagged what, the facilitator has lost the room. Summarise and move to the decision.
Too many injects. Four to six decisions in two hours is plenty. Executives need time to disagree.
No pre-read. The first 30 minutes are then spent explaining the crisis structure.
The CISO facilitates and plays. They cannot do both well, and their real role is one of the things being tested.
No follow-through. Executive exercises create high expectations. If the improvement actions are not tracked and reported, the next session will be harder to schedule.