What a Ransomware Tabletop Exercise Looks Like

“We don't have time for a tabletop exercise right now” is the most common objection we hear — usually from teams that assume it means a multi-day simulated outage. It doesn't. Here’s what actually happens, start to finish.

Before the room: two to three weeks of setup

A tabletop exercise starts well before anyone sits down. The consulting team reviews your existing incident response (IR) plan, network diagram, backup architecture, and any prior incident history. From that, they build a scenario calibrated to your actual environment — not a generic ransomware storyline, but one that targets your organization’s systems, vendors, and dependencies. Participants are identified across IT, security, legal, communications, and executive leadership, because a real ransomware event pulls in all of them, not just IT.

The exercise itself: three to four hours, one room

The exercise runs as a facilitated discussion, not a live fire drill. The facilitator introduces the scenario in stages — an initial alert, then an escalation, then a complication — and at each stage, asks the room what the plan says should happen next, and who's responsible for making it happen. That's the moment the plan stops being theoretical.

Common moments where plans stall:

• The call tree references a role or a person who has since changed.

• Nobody in the room can say with confidence which backups are isolated from the production network.

• The cyber insurance carrier's notification requirements aren't reflected anywhere in the plan.

• Legal and communications don't know at what point they're supposed to be looped in.

None of this reflects poorly on the team — it's what tabletop exercises are intended to find.

Our companion case study, built from a real (anonymized) executive tabletop exercise at a regional food and beverage manufacturer, covers exactly this scenario at the executive level.

After the room: the turning point

The exercise produces a gap report of plain-language findings organized by owner (IT, legal, communications, executive), each with a recommended fix. This is the deliverable that turns a three-hour conversation into a defensible, board-ready improvement plan.

“We just did a penetration test”

This is the second most common objection, and it points to a real but different exercise. A pen test finds technical vulnerabilities, like a misconfigured server or an unpatched service, that a bad actor could exploit. A tabletop exercise tests whether your organization can execute its response under pressure — the decisions and coordination, not the infrastructure. You need both, and they work best in sequence: many of our clients run the pen test first to close the technical gaps it finds, then build the next tabletop exercise's scenario around whatever access path the pen test used to get in, so the people-and-process test picks up exactly where the technical test left off.

We're publishing a free Tabletop Exercise Prep Checklist next week — no form required.

Check back on the Ransomware Readiness page to get notified the day it's live.