How an incident-response tabletop exercise works
There’s no mystery to how these run. A realistic incident, your team working it in the roles they hold, and a debrief that turns the whole thing into something you can act on. Here is each part, and what it is actually for.
How an exercise runs
1. A scenario built around a realistic incident
Every exercise starts with a scenario. Sometimes it’s a generic incident that fits your sector, sometimes it’s built around your own systems and your own worst week, depending on why you’re running it. Either way it’s plausible: the kind of incident your team could genuinely face, so you can see what they reach for.
2. The team works it in real time, in role
People take the roles they actually hold, or the ones they would hold in a real incident. Then they work the problem as it unfolds. The situation moves based on what they decide. If they contain it early, the scenario responds to that. If they miss something, that shows up later in the scenario, as it would on the day. The talking happens across the table, between the people who would actually have to talk.
3. A debrief, straight after
The moment the scenario ends, we debrief. I walk back through what happened, beat by beat. Each function describes how they read it at the time, what they knew, and what they assumed. Then every observation gets tied back to your actual plans, your controls, and the places where those came up short.
Guide, not judge
My job in the room is to surface what your plan covers and what it doesn’t. Nobody leaves the debrief with a personal score. If someone made the wrong call, the interesting question is almost always why the plan let them. Good instinct comes from room to get it wrong somewhere safe.
What it takes
I’m based in Copenhagen and run exercises on site across Europe, or remotely, in English or Danish. I facilitate on my own for groups of up to about eight people. Larger groups get a second person. Everything else, the roles, whether the scenario is generic or built around you, gets shaped to what you’re trying to get out of it.
That’s the method. If you want the wider picture of why exercises like this build instinct a slide deck can’t, start with the overview. When you’re ready to run one, tell me where your team is and what you want them to practice, and we’ll find a date.
