Facilitating a Tabletop Exercise: Techniques That Work

Facilitation is the difference between a tabletop that uncovers real gaps and one that becomes a polite meeting. The facilitator's job is not to know the answers; it is to create the conditions in which the group discovers what it does not know, and to make sure that discovery is captured. This guide covers the techniques that matter most, with a script you can adapt and a question bank for common situations.

This article assumes the exercise is already designed. For planning and staffing, see how to run a tabletop exercise and tabletop exercise roles.

The facilitator's three jobs

1. Hold the frame. Ground rules, timing, the scenario premise and the objectives. When discussion drifts, bring it back.
2. Draw out decisions. Push past "we would investigate" to who, how, how long and with what authority.
3. Protect candour. Make it safe to say "I don't know" or "our plan doesn't cover that". Candour is where findings come from.

Everything below serves one of these three jobs.

Opening: set ground rules that people believe

The first ten minutes decide whether people speak freely. Cover these points explicitly, and have the sponsor endorse them if they are present:

• This is not a test of individuals. We are testing plans, processes and coordination.
• No-fault, no-blame. Gaps found today are successes, not failures.
• Respond as you would in reality, with the resources and information you would really have. No heroics, no invented tools.
• Accept the scenario premise. Details may not match your environment exactly; work with them.
• "I don't know" is a valid answer. It will be recorded as a gap in the plan, not in the person.
• What is said in the room stays in the room. Findings appear in the report without attribution to individuals, similar to the Chatham House Rule.
• Devices down except for tools players would genuinely use, such as the IR plan or contact list.

Then brief the logistics: timing, breaks, how injects will arrive, what the scribe is doing and what happens after the exercise.

A short opening script

Thanks for giving us the next two and a half hours.

Today we'll walk through a simulated incident together. I'll share the
situation in stages. After each update, I'll ask you what you'd do,
who you'd involve and what you'd need.

A few rules. This isn't a test of anyone here — we're testing our plans
and how we work together. If the honest answer is "I don't know" or
"our plan doesn't say", that's exactly what we want to hear: it's a gap
we can fix before a real incident finds it.

Please respond as you would in reality, with the people and tools you'd
really have. If a detail doesn't match our environment, go with it for
now and tell me — we'll note it.

[Scribe] is capturing decisions and questions, without names. We'll
finish with a 20-minute hotwash and you'll see the report within two weeks.

Let's begin. It's Thursday, 16:40...

Reading the starting situation

Set the scene slowly and concretely: the day and time, who is on shift, what is happening in the business. A starting situation that includes "it is the Friday before a long weekend and the CFO is on a flight" creates realistic pressure without any technical detail. After reading it, ask each player to state their role and, briefly, what they would be doing right now. This gets every voice into the room early.

Pacing and time compression

Tabletops run in exercise time, which moves faster than real time. Each inject advances the clock: "It is now T+2 hours." Say the new time aloud and write it somewhere visible.

Useful pacing techniques:

• Timebox each module. Know which injects you can skip if discussion runs long. Mark them optional in the MSEL.
• Use "it is now" statements to jump past activity that would take hours in reality: "Your team has spent the last four hours imaging hosts. Here's what they found."
• Summarise before each inject. "So far: severity 1 declared, crisis team activated, legal engaged, containment not yet decided." This keeps late joiners aligned and surfaces disagreements.
• Don't fill silence too quickly. Count to ten. Silence usually means people are thinking, or that nobody owns the decision, which is itself a finding.

Drawing out decisions: probing questions

Players naturally answer at a high level: "We'd investigate", "We'd contain it", "Comms would handle that". The facilitator's main tool is the follow-up question.

Two general-purpose probes work in almost every situation: "Who owns that decision?" and "What would you need to know to make it?"

Handling group dynamics

The dominant voice

Often the most senior or most technical person answers everything. Techniques:

• Direct questions by role: "Let's hear from communications first on this one."
• Round-robin a key decision: each role gives a one-sentence position.
• Thank the dominant speaker and explicitly park their point: "Great, let's capture that and hear what legal would need."
• Talk to them at the break. Most people are receptive when told the exercise needs to test their deputies' knowledge too.

The silent executive

Executives sometimes stay quiet to avoid influencing the group, or because the discussion is too technical. Translate: "In business terms, the team is proposing to take the order system offline for up to a day. Is that a decision you'd expect to be asked to make?" Executive decisions are often the most important findings, so make room for them.

Fighting the scenario

When players argue the scenario could not happen, acknowledge, park and continue: "Fair point, let's note it. For today, assume it did. What next?" If the objection reveals a genuine control you did not know about, that is a strength. Record it.

Rabbit holes

Technical teams can spend twenty minutes debating a log source. When a thread is not serving the objectives, name it: "This is important, and it's a good parking-lot item. For now, assume you've confirmed the host is compromised."

The parking lot

Keep a visible list of issues raised but not resolved. It shows people they have been heard, lets you move on, and feeds directly into the after-action report. Review it during the hotwash.

Using the controller and simulated parties

If you have a controller playing outside parties, encourage players to "make the call". When a player says "we'd contact the bank", the facilitator can turn to the controller: "The bank is on the line." The controller answers in character, often with questions players must be ready for: account details, authorisation, reference numbers. This converts abstract answers into concrete tests. See white cell.

Remote and hybrid facilitation

Remote tabletops work, but they need more structure:

• Assign a co-facilitator to watch chat, hands and the remote participants.
• Share each inject on screen and in the chat so late joiners can catch up.
• Call on remote players by role, early and often; they are easy to forget.
• Shorter modules, with a check-in at the end of each.
• Agree the camera policy and a signal for "I want to speak".
• Test the platform, screen sharing and breakout rooms beforehand.

Hybrid sessions (some in the room, some remote) are the hardest. If possible, give remote players a dedicated facilitator, or ask everyone to join from their own laptop even in the room.

Running the hotwash

The hotwash is the structured debrief immediately after play, while memories are fresh. Allow 15 to 30 minutes. A simple structure:

1. Round-robin by role: one thing that worked, one thing that did not.
2. Top gaps: the facilitator reads back the parking lot and the scribe's main gaps; the group confirms or corrects.
3. Top three fixes: what should change first, and who should own it.
4. Feedback on the exercise itself: realism, timing, what to test next time.

Close by explaining what happens next: draft report date, how findings will be tracked and when the next exercise will take place.

A facilitator's question bank

Keep this on a card during the exercise.

Common facilitation mistakes

• Answering players' questions about what they "should" do.
• Letting one module overrun and cutting the communications or recovery modules, which are often where the biggest gaps sit.
• Skipping the hotwash because time ran out. Cut an inject instead.
• Recording findings with names attached.
• Treating the exercise as a success because it went smoothly. A smooth exercise usually means injects were too easy.

Related

• Designing tabletop injects and the MSEL
• Scoring tabletop exercises
• Writing the after-action report
• Glossary: hotwash, inject