Tabletop exercises (TTXs) are an essential tool in building an organization’s resilience to cyber threats, providing a controlled environment to simulate potential incidents. These exercises allow teams to test their responses, evaluate procedures, and identify gaps in their crisis management plans. However, simply going through the motions isn’t enough to ensure preparedness—effective TTXs must strike a balance between realism, adaptability, and learning outcomes.
In one of my recent TTX sessions, I introduced a new dynamic by priming AI to provide real-time injects, adding a level of unpredictability and immersion to the exercise. The result was a more engaging and challenging experience for the participants, ultimately improving their response planning. In this blog, I’ll discuss the elements that make a TTX effective and highlight the benefits of using AI for injects in real-time scenarios.
A good tabletop exercise starts with clear objectives and well-defined scope. Whether your goal is to test your incident response plan, refine communication protocols, or practice decision-making under pressure, knowing the focus of the exercise is crucial. In my recent TTX, the organization wanted to evaluate their ability to handle a complex, multi-stage ransomware attack. Having a specific scenario in mind helped shape the exercise, keeping it relevant and targeted.
To ensure success, involve key stakeholders from different parts of the organization, such as IT, legal, public relations, and executive leadership. Each function plays a vital role in incident response, and the exercise should reflect that. By involving a diverse group, the TTX not only evaluates technical responses but also tests communication, leadership, and decision-making capabilities across the company.
One of the biggest challenges in TTXs is maintaining a sense of realism. While the exercises are simulated, it’s easy for participants to treat them as hypothetical, failing to capture the real-time pressure and fluidity of an actual crisis. At GroupSense, we are able to draw on our years of Ransomware Response cases that bring real world situations to the table. As part of our R3S ransomware preparedness and prevention program, we not only stand at the ready for our clients, but help them proactively prevent and prepare in the event of an incident.
For this particular exercise, I primed an AI to provide injects in real time based on the evolving scenario. Prior to the TTX, I primed the generative AI with previous scenarios and guidelines that would ensure the AI generated injects were within scope and context. The AI was able to adapt to the organization’s responses, creating a more dynamic and realistic experience. For example, if the IT team swiftly identified a ransomware attack vector and took decisive action, the AI might introduce a new wrinkle—perhaps a phishing campaign running concurrently or a disruption in communications with external partners. These injects kept participants on their toes, forcing them to pivot and adapt as new information came in, much like they would have to in a real-world incident.
This real-time adaptability made the exercise more immersive and unpredictable. It moved away from a scripted, step-by-step walkthrough, allowing for organic and spontaneous decision-making. More importantly, it gave the organization a better sense of how they would truly respond in a crisis, when not everything goes according to plan.
Surprise is an essential element of any good TTX. Cyber incidents are, by their very nature, unpredictable, and your response team must be ready to handle the unknown. Injecting surprise into your exercises is one of the best ways to simulate this unpredictability.
Incorporating AI to provide real-time injects adds a level of surprise that is hard to replicate with traditional, human-driven exercises. The AI doesn’t just follow a script but reacts to the decisions the participants make in real time. In my recent exercise, this dynamic added layers of complexity that wouldn’t have been possible otherwise. It prevented participants from becoming too comfortable or reliant on a pre-set plan. Instead, they had to think critically, communicate effectively, and adjust their actions on the fly.
One participant noted that the unpredictability of the injects made the exercise feel much closer to a real-world scenario, where multiple factors can change the situation at any moment. That sense of urgency led to more meaningful discussions afterward, as participants could reflect on how their decisions would have fared in a genuine crisis.
A tabletop exercise isn’t complete without a thorough post-exercise analysis (commonly known as a "hotwash"). This is where the real learning happens. What went well? What decisions or actions created complications? What gaps were identified in the response plan, and how can they be addressed before a real incident occurs?
In the case of my AI-augmented TTX, the organization found that the unpredictable injects revealed some communication challenges within their team. While they had strong technical capabilities, there were delays in decision-making due to unclear roles and responsibilities, particularly in communicating with external parties. By surfacing these issues during the exercise, the organization was able to take proactive steps to improve their crisis management process.
One of the benefits of using AI for injects is the ability to generate detailed logs of every interaction during the exercise. This provides a rich dataset for analysis, enabling facilitators to track response times, decision points, and the overall flow of the incident. By reviewing this data, organizations can gain a deeper understanding of their strengths and weaknesses, leading to more actionable insights for future planning.
Following the hotwash process, we did a workshop to walk through the supporting documents including the communication plan and insurance policy.
Tabletop exercises are a cornerstone of any robust incident response strategy, but they need to be executed effectively to deliver real value. By defining clear objectives, incorporating key stakeholders, and injecting surprise through real-time AI, organizations can create more realistic and impactful simulations. The use of AI injects in my recent TTX added a level of complexity that challenged participants and revealed critical gaps in their response plan.
As cyber threats continue to evolve, organizations must continually refine their response capabilities. TTXs are an invaluable tool in this process, and with the addition of real-time AI-driven injects, they can become even more powerful. The result is not just a better-prepared response team but a more resilient organization overall.
Click Here to Talk to a GroupSense professional about how GroupSense's R3S Ransomware Preparedness and Response program is helping companies improve their resilience and tailoring TTX to address ransomware threats.