What is the difference between a tabletop, functional and full-scale exercise?

A tabletop is discussion-based: participants talk through how they would respond to a scenario, and nothing is actually done. A functional exercise has teams perform their real functions, such as coordinating and making decisions, in a simulated environment under time pressure, usually without deploying resources. A full-scale exercise is the most realistic: multiple organisations act in real time with real systems, people and resources.

What are the seven types of exercises in HSEEP?

HSEEP divides exercises into two families. Discussion-based exercises are seminars, workshops, tabletop exercises and games; they focus on plans, policies and decisions. Operations-based exercises are drills, functional exercises and full-scale exercises; they involve people actually carrying out tasks. Programmes typically progress from discussion-based to operations-based as capability matures.

Is a red team exercise a full-scale exercise?

Not in HSEEP terms. A red-team engagement tests technical controls and detection by simulating a real attacker, and defenders may not know it is happening. A full-scale exercise is a planned, announced rehearsal of the whole response. The two can be combined: a purple-team exercise or a red-team scenario can drive a functional or full-scale exercise for the response teams.

Which type of exercise should we start with?

Start with a tabletop exercise, or with a seminar if your incident-response plan is brand new. Discussion-based exercises are cheap, low-risk and surface the gaps in roles, authority and communication that would make an operations-based exercise chaotic. Move to drills and functional exercises once the plan and roles are stable.

Tabletop vs Functional vs Full-Scale Exercise: Cyber Guide

A tabletop exercise is a discussion: players talk through a scenario and nothing is actually done. A functional exercise has teams carry out their real functions in a simulated environment under time pressure. A full-scale exercise is a live, multi-team rehearsal using real systems, people and resources. Each step up adds realism, cost and risk.

Those three are the best known, but the Homeland Security Exercise and Evaluation Program (HSEEP), FEMA's exercise doctrine, defines seven exercise types in two families. This guide explains each one with a cyber example, compares them side by side and shows how to combine them into a progressive programme, including where cyber ranges and red or purple teaming fit.

Two families: discussion-based and operations-based

HSEEP groups exercises by what participants actually do.

Discussion-based exercises focus on plans, policies, agreements and decisions. Participants talk; they do not act. They are cheap, low-risk and ideal for building shared understanding. The four types are seminars, workshops, tabletop exercises and games.

Operations-based exercises have participants actually perform tasks: run procedures, use tools, move resources, communicate over real channels. They validate that plans work in practice, and they cost more to plan and run. The three types are drills, functional exercises and full-scale exercises.

NIST SP 800-84, the guide to test, training and exercise programmes for IT plans, draws a similar line between tabletop and functional exercises, so the vocabulary carries over well to cyber.

Discussion-based exercise types

Seminar

An informal briefing that introduces a plan, policy or capability. A presenter leads; there is little decision-making.

Cyber example: the security team walks the extended leadership team through a newly approved incident-response plan: severity levels, who declares an incident, how the crisis team is convened and where the out-of-band contact list lives.

Use it when: the plan is new, the audience is new, or you need people to understand the basics before you test them.

Workshop

A working session that produces something: a draft plan, a set of objectives, a policy. Participation is higher than in a seminar and there is a tangible output.

Cyber example: legal, privacy, communications and security draft the decision tree for regulatory notification after a data breach, including who decides, what evidence they need and which deadlines apply.

Use it when: you have a gap to fill rather than a plan to test. Workshops often follow a tabletop that exposed missing procedures.

Tabletop exercise

A facilitated discussion of a realistic scenario, with new information released in stages through injects. Players describe what they would do, who they would call and what they would decide. See what a tabletop exercise is for a fuller definition.

Cyber example: a ransomware scenario that starts with an EDR alert and escalates through encrypted servers, a ransom demand and a journalist's call, as in the ransomware tabletop scenario.

Use it when: you want to test roles, decisions, coordination and assumptions without touching systems. This is the workhorse of most cyber exercise programmes.

Game

A simulation, often competitive, in which teams make decisions under defined rules and see the consequences play out. Games can run in rounds, with each team's choices affecting the next state of play.

Cyber example: two teams, one defending and one playing the attacker, take turns choosing moves on a simplified map of the network. After each round, a white cell adjudicates the outcome. This helps leaders understand how attacker choices and defensive investments interact.

Use it when: you want to explore strategy, trade-offs or consequences over time, such as security investment choices or a prolonged campaign.

Operations-based exercise types

Drill

A coordinated, supervised activity that tests one specific function or procedure. Drills are narrow by design and are often repeated.

Cyber examples: restoring a critical database from backup and timing it against the recovery time objective; calling down the out-of-band contact list at 2 a.m. to see who answers; executing the playbook to revoke and rotate a leaked cloud access key.

Use it when: you need to prove that a procedure actually works and measure how long it takes. Drills turn assumptions made in tabletops ("restores take four hours") into evidence.

Functional exercise

Teams perform their real functions, in real time, in a simulated environment. Typically the exercise tests coordination, command and control and decision-making across teams, while a simulation cell plays everyone outside the exercise: attackers, customers, regulators, the press. Resources are usually not physically deployed.

Cyber example: the SOC, IR team, IT operations and the crisis team work from their usual locations using their real ticketing and chat tools. A control cell sends simulated alerts, log extracts and emails from "the regulator" on a schedule. Teams must triage, escalate, decide and communicate under the clock.

Use it when: the tabletop results are stable and you want to see whether the process holds up under time pressure, with real tools and real hand-offs.

Full-scale exercise

The most complex and realistic type. Multiple organisations or functions respond in real time, using real systems and resources, often across locations. Planning can take months.

Cyber example: a sector-wide exercise in which several organisations, their managed service providers and a national CSIRT respond to a simulated supply-chain compromise, with real containment actions performed on isolated or pre-agreed systems and real public-information coordination.

Use it when: you need to validate the whole response end to end, including external partners, and you have the maturity and budget to do it safely.

Comparison table

Type	Family	Main purpose	Participants	Realism	Cost and effort	Typical duration	Typical outputs
Seminar	Discussion	Orient people to a plan or capability	Any size, mostly listening	Low	Very low	1–2 h	Shared understanding, questions log
Workshop	Discussion	Build a product: plan, policy, procedure	Small working group	Low	Low	Half day	Draft document, decisions
Tabletop	Discussion	Test roles, decisions and coordination against a scenario	6–15 decision-makers	Moderate (narrative)	Low	2–4 h	Gaps, after-action report, improvement plan
Game	Discussion	Explore strategy and consequences under rules	Two or more teams	Moderate	Low to moderate	2 h to a day	Insights on trade-offs, strategy
Drill	Operations	Validate one procedure and measure it	One team	High for that task	Low to moderate	Minutes to hours	Timings, pass/fail against procedure
Functional	Operations	Test coordination and decisions in real time with real tools	Several teams plus a control cell	High	Moderate to high	Half day to full day	Timelines, coordination gaps, AAR
Full-scale	Operations	Validate end-to-end response with real resources	Multiple organisations	Highest	High	One or more days	Comprehensive AAR, validated capabilities

Building a progressive exercise programme

HSEEP recommends a building-block approach: each exercise builds on the last, increasing in complexity as capability matures. For a cyber programme, a sensible progression looks like this.

Seminar on the incident-response plan, so everyone knows their role and the vocabulary.
Tabletop with the technical response team on a common scenario, such as business email compromise or ransomware.
Workshop to fix the procedures the tabletop exposed, such as the notification decision tree or containment authority.
Executive tabletop to test the decisions only leaders can make. See the executive tabletop guide.
Drills to validate the assumptions everyone made in the tabletops: backup restores, contact call-downs, key rotation.
Functional exercise that combines teams, tools and time pressure, once roles are clear and drills pass.
Full-scale exercise, if your size, sector or regulator justifies it.

Not every organisation needs all seven. Many mature programmes cycle between tabletops and drills for years and add a functional exercise only occasionally. The tabletop exercise programme guide covers cadence and an annual calendar.

A practical rule: do not move up a level until the previous level's findings are closed. A functional exercise run on top of unclear roles produces chaos, not learning.

Where cyber ranges and simulations fit

A cyber range is a controlled, isolated environment that mimics real networks and systems, where people can practise detection and response against simulated attacks without risk to production. In HSEEP terms, range-based training usually falls between a drill and a functional exercise: participants perform real technical tasks with real tools, but in a sandbox.

Ranges are excellent for building analyst skill and testing technical playbooks. They are less useful for testing business decisions, communications and legal processes, which is where tabletops remain stronger. Many organisations pair the two: a range exercise for the SOC and IR team, followed by a tabletop in which the crisis team receives the SOC's findings and has to make the business decisions.

Online simulation tools sit on a spectrum too. Some are essentially facilitated tabletops with digital inject delivery; others simulate systems. You can run a discussion-based exercise live with the exercise runner, where injects go to players' phones and decisions are captured for the report.

Where red, blue and purple teaming fit

Red-team engagements, penetration tests and breach and attack simulation test technical controls and detection. They answer "can an attacker get in, and would we notice?" rather than "do we respond well?". Because they are not planned rehearsals of the response, they do not map neatly onto HSEEP's seven types.

They do connect to the programme in useful ways:

Red team as scenario source. The attack path from a red-team report is a realistic, organisation-specific basis for a tabletop.
Purple teaming as a drill. When attackers and defenders work together, running techniques and checking detections one by one, the result behaves much like a series of technical drills.
Red team driving a functional exercise. A pre-announced red-team action can generate real alerts for a functional exercise, with the response teams working in real time.

Under DORA, certain financial entities must also carry out threat-led penetration testing (TLPT), which sits alongside the broader resilience testing programme. The full comparison is in tabletop exercise vs red team.

Choosing the right type

If your goal is to…	Use
Introduce a new plan	Seminar
Write or fix a procedure	Workshop
Test who decides what, and how teams coordinate	Tabletop
Explore strategy or long-running consequences	Game
Prove a backup restore or call-down actually works	Drill
Test coordination under real time pressure with real tools	Functional exercise
Validate the whole response with partners and real resources	Full-scale exercise
Test whether controls stop or detect a real attacker	Red team, penetration test or BAS

Whatever the type, the evaluation discipline is the same: objectives before scenario, observable criteria, a hotwash and an improvement plan with owners and dates.