INCIDENT READINESS & TABLETOP EXERCISES: Rehearse the decisions an incident will demand.
Incident readiness and tabletop exercises test how people make decisions during a simulated security incident. Subdux develops scenarios around your business, examines escalation, response authority and communications, then helps turn the lessons into changes to plans and working arrangements before those decisions are needed under real pressure.
- Discipline
- Managed Security & Advisory
- Engagement type
- Advisory
Test the handoffs before they become urgent.
Technology teams may recognise a need to isolate systems while operations weighs a service interruption. Leadership may need to communicate before the full facts are available. A supplier may hold information the response depends on. A tabletop brings these competing needs into the same discussion, using a scenario relevant to the way your business operates.
Best suited to organisations preparing a new response plan, rehearsing cross-functional roles, onboarding a response provider or revisiting lessons from an incident. A focused exercise can involve one decision group; a broader rehearsal can involve leadership, IT, operations, communications and legal advisers.
Put the plan through a situation it needs to handle.
A relevant scenario
Choose an event such as ransomware, a compromised account, customer-data exposure or a supplier outage, with consequences suited to the organisation.
Progressive developments
Introduce new information during the exercise so participants must reassess earlier assumptions and priorities.
Authority and escalation
Explore who can authorise disruptive action, involve external specialists and decide when the situation needs senior attention.
Communication and dependencies
Work through internal updates, customer questions, external obligations and the information needed from partners.
Recovery choices
Examine how restoration priorities, evidence preservation and operational constraints influence the response.
Leave with changes worth making.
We review relevant plans and contacts, agree the exercise objectives and facilitate the session with clear separation between the scenario and live operations. Observations focus on missing information, conflicting assumptions and obstacles to action. The debrief distinguishes a discussion gap from a capability that would need practical testing.
What you receive
A tailored exercise scenario; facilitator observations and an after-action summary; prioritised improvements to plans, contacts and escalation routes; and a follow-up plan for rehearsal or technical validation. Updating the response documentation can be included alongside the exercise.
Will the exercise interrupt our systems?
A tabletop is a discussion-based exercise and does not require attacks or changes to production systems. Live technical testing or recovery drills are separate activities with their own preparation.
Do we need a complete response plan first?
No. A planning workshop can help establish the initial arrangements. An exercise is more useful once participants have enough context to rehearse how those arrangements would work.
Does the exercise include an incident response retainer?
A readiness exercise and access to response support are separate arrangements. If you want both, the availability, contacts and response scope need to be established explicitly before an incident occurs.
Choose a situation your team needs to be ready for.
Tell us who would be involved, which services matter most and whether you already have a response plan to rehearse.
Related services: Incident Response and Virtual CISO.