https://www.cybertabletop.org/en/blog Latest from Blog en Tue, 27 Oct 2026 19:09:36 GMT https://www.cybertabletop.org/en/blog/cisa-tabletop-exercise-packages https://www.cybertabletop.org/en/blog/cisa-tabletop-exercise-packages What CISA tabletop exercise packages (CTEPs) contain, their strengths and limits, and how to adapt a free CTEP to your organisation and run it live. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/deepfake-ceo-fraud-tabletop https://www.cybertabletop.org/en/blog/deepfake-ceo-fraud-tabletop A deepfake tabletop exercise: a synthetic CEO on a video call pressures the CFO into an urgent wire, then a fake audio clip goes viral. 8 injects with a rubric. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/executive-tabletop-exercise https://www.cybertabletop.org/en/blog/executive-tabletop-exercise How to run an executive tabletop exercise: the decisions to force, a 2-hour agenda, briefing without jargon, facilitating senior rooms and reporting to the board. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/healthcare-ransomware-tabletop https://www.cybertabletop.org/en/blog/healthcare-ransomware-tabletop A healthcare ransomware tabletop exercise: EHR and imaging encrypted overnight, ambulance diversion, paper downtime and HIPAA decisions. 9 injects, 3 hours. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/hipaa-tabletop-exercise https://www.cybertabletop.org/en/blog/hipaa-tabletop-exercise Plan a HIPAA tabletop exercise that tests incident procedures, contingency plans and breach notification, with attendees, scenarios and a checklist. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/identity-provider-compromise-tabletop https://www.cybertabletop.org/en/blog/identity-provider-compromise-tabletop An identity provider compromise tabletop: MFA fatigue and help-desk fraud hand an attacker SSO super-admin. 9 injects on federation, break-glass and cutting SSO. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/lost-laptop-data-breach-tabletop https://www.cybertabletop.org/en/blog/lost-laptop-data-breach-tabletop A lost laptop tabletop exercise: a stolen manager's device, unproven encryption, HR data and a surprise MDM check-in. 7 injects for legal, HR and IT. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/nis2-dora-tabletop-exercise https://www.cybertabletop.org/en/blog/nis2-dora-tabletop-exercise How a NIS2 tabletop exercise (and its DORA equivalent) tests reporting clocks, management oversight and continuity, and what evidence to keep for supervisors. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/ot-ics-incident-tabletop https://www.cybertabletop.org/en/blog/ot-ics-incident-tabletop An OT tabletop exercise for manufacturers: IT ransomware, an HMI with unexplained setpoint changes and a safety-first shutdown decision. 9 injects, 3 hours. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/phishing-credential-theft-tabletop https://www.cybertabletop.org/en/blog/phishing-credential-theft-tabletop A ready-to-run phishing tabletop exercise: an adversary-in-the-middle kit steals finance sessions despite MFA. 8 timed injects, questions and a scoring rubric. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/small-business-tabletop-exercise https://www.cybertabletop.org/en/blog/small-business-tabletop-exercise Run a tabletop exercise for your small business in 90 minutes with no security team: who plays what, 5 SMB scenarios, a prep checklist and a one-page agenda. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/tabletop-exercise-compliance-requirements https://www.cybertabletop.org/en/blog/tabletop-exercise-compliance-requirements Tabletop exercise requirements across SOC 2, ISO 27001, PCI DSS, NIST, NIS2, DORA, HIPAA, SEC rules and cyber insurance, with the evidence auditors expect. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/tabletop-exercise-examples https://www.cybertabletop.org/en/blog/tabletop-exercise-examples 20 cybersecurity tabletop exercise examples grouped by threat, each with a premise, audience, difficulty and the key decision it forces. 14 are ready to run. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/tabletop-exercise-program https://www.cybertabletop.org/en/blog/tabletop-exercise-program How often should you conduct a tabletop exercise? Cadence by audience, triggers for extra sessions, a 12-month calendar and the metrics to report. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/tabletop-exercise-questions https://www.cybertabletop.org/en/blog/tabletop-exercise-questions 105 tabletop exercise questions for incident response, organised by phase and by role, plus how to ask them and weak-vs-strong question rewrites. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/tabletop-exercise-template https://www.cybertabletop.org/en/blog/tabletop-exercise-template A free, copy-paste cyber tabletop exercise template: overview, roles, agenda, MSEL, inject cards, evaluation guide, hotwash and after-action report outline. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/tabletop-exercise-vs-red-team https://www.cybertabletop.org/en/blog/tabletop-exercise-vs-red-team Tabletop exercise vs red team, pen test, purple team and BAS: what each tests, when to use which, how they feed each other, plus a combined annual plan. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/third-party-vendor-breach-tabletop https://www.cybertabletop.org/en/blog/third-party-vendor-breach-tabletop A third-party breach tabletop exercise: your file-transfer vendor is mass-exploited and you hear it from the news. 8 injects on scoping, contracts and notification. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/types-of-security-exercises https://www.cybertabletop.org/en/blog/types-of-security-exercises Tabletop vs functional vs full-scale exercise explained: the seven HSEEP exercise types with cyber examples, a comparison table and how to build a progressive programme. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT https://www.cybertabletop.org/en/blog/what-is-a-tabletop-exercise https://www.cybertabletop.org/en/blog/what-is-a-tabletop-exercise What is a tabletop exercise? A clear definition, how a cyber TTX runs before, during and after, who attends, what it tests, formats, frequency and pitfalls. Florian Amette Mon, 28 Sep 2026 00:00:00 GMT