Tabletop and live simulations¶
Tabletop and live simulations let teams test procedures, explore communication strategies, and practise continuity planning.
Most incident exercises are polite performances: a few slides, a scripted scenario, and then everyone goes back to email. That makes for nice PowerPoints but weak preparedness. Real operational resilience demands messy rehearsal: live decisions, messy trade-offs, communication friction, and the human stress that reveals where plans actually break.
This workshop is different. It is an adaptable, immersive facilitation process designed to turn plans on paper into practiced habits. We run tabletop games for strategic clarity and live injections for process muscle — then we force the team to close the gap between what they think they will do and what they actually do.
Core principles¶
Practise don’t preach: learning happens through doing, not slideware. Exercises emphasise hands-on decision cycles and repeatable actions.
Safe realism: scenarios are realistic and uncomfortable, but the environment is blame-free so teams can learn without fear.
Role clarity and communication: incidents are primarily human problems — we focus on who speaks when, what channels to use, and how to preserve situational awareness.
Adaptable fidelity: we scale fidelity to needs — from tabletop (90–120 minutes) to full live injection (multi-hour, multi-team).
Evidence for learning: every exercise finishes with concrete outputs — decisions made, time-to-decision metrics, and a short improvement backlog.
How it works: modular structure¶
The workshop is split into modular parts so you can choose the right intensity and duration.
Orientation: set the stage (15–30 minutes)
Quick primer on objectives, safety rules, and timing.
Decide roles: incident commander, comms lead, technical lead, liaisons, observers.
Agree the scope and “do not touch” constraints (systems we will not disrupt).
Tabletop: clarify the plan (60–120 minutes)
Scenario briefing: a short, sharp narrative that establishes the incident (service outage, data exfiltration, ransomware, supply chain failure, etc.).
Guided play: teams talk through decisions round by round. Facilitator introduces complications and new facts to surface dependencies.
Focus: decision triggers, escalation thresholds, external communications, and cross-team coordination.
Live injections: practise under pressure (1–4 hours)
Controlled, safe disruptions are injected into real workflows: simulated alerts, fake press enquiries, a “compromised” account, or a broken vendor API.
Teams must act in real time, using their normal tools and channels. Observers record timings, handoffs, and friction points.
Optionally run a parallel red team to escalate pressure and realism.
Comms rehearsal: internal and external (30–60 minutes)
Draft and deliver short internal messages and an external statement. Practice hotlines, executive briefings, and spokesperson handovers.
Emphasise speed + accuracy: how to avoid releasing unverified details and how to maintain trust under pressure.
Rapid retrospective and action capture (30–45 minutes)
What worked? What surprised us? Where did escalation stall?
Produce a short, prioritised improvement list: fixes, playbook tweaks, owner and due date.
Capture a one-page “after action” summary and a one-page immediate playbook for the next 72 hours.
Typical outputs¶
A one-page incident playbook tailored to the team (who does what, how to escalate, comms templates).
A short improvement backlog with owners and dates.
Recorded decision timeline and incident log for training and audit.
Optional: a short video clip of key decision points for team learning.
Who it is for¶
Incident response and security teams who need to practise coordination under pressure.
Senior leaders who must get confident making fast, evidence-based decisions.
Communications and legal teams who must work in lockstep with operations.
Cross-functional operational teams (platform, product, customer service) who must practise continuity and customer handling.
Formats & duration¶
Primer (90 minutes): tabletop + rapid retro — good for first timers and leadership alignment.
Standard (half-day): tabletop, comms rehearsal, and detailed retro.
Immersive (full day): tabletop + live injections + comms + deep after action.
Enterprise (multi-day): scenario chaining, extended live ops, and playbook design with documentation handover.
Optional add-ons¶
Evidence capture & metrics: automated logging of response timings and handoffs.
Custom red team: scripted adversary to increase realism.
Playbook authoring: we turn outputs into polished, team-specific runbooks.
Follow-up coaching: short coaching sessions to embed changes and support adoption.