Glossary
Tabletop exercise
A discussion-based exercise in which a team talks through a simulated incident to test plans, roles and decisions without touching real systems.
A tabletop exercise (TTX) is a facilitated, discussion-based session in which participants walk through a realistic scenario, such as a ransomware attack or a data breach, and describe how they would respond. A facilitator introduces new information in stages through injects, and the group discusses decisions, responsibilities and communications as the situation evolves.
Nothing is attacked and no systems are changed. What is tested is the incident-response plan, the clarity of roles and decision rights, and the coordination between teams such as security, IT, legal, communications and leadership.
Tabletops sit at the lighter end of the exercise spectrum, below functional and full-scale exercises. They are inexpensive, low-risk and effective at exposing organisational gaps: unclear authority, missing contacts, untested assumptions about backups or out-of-band communications. NIST SP 800-84 describes tabletop exercises as a way to validate IT plans, and the HSEEP methodology offers a common structure for designing and evaluating them.
A typical cyber tabletop lasts two to four hours and ends with a hotwash and a written after-action report. For the full picture, read what is a tabletop exercise, then how to run one.