Incident & Ransomware Tabletop – rehearse your worst day before it happens.
Book Intro Call
Executive Add-On • Scenario-Based • Leadership Team

Incident / Ransomware Tabletop

On your worst IT day, the technology is only half the story. The real questions are: who decides what, in what order, and with what information? This tabletop exercise lets your leadership team rehearse a realistic incident before it becomes tomorrow’s headline.

Talk About a Tabletop Exercise Back to Executive IT Strategy Club
Format: 90–120 minute live virtual or hybrid session. Optional follow-up for deeper remediation planning.
You’ll walk away with:
  • ✔Shared understanding of who does what in a crisis
  • ✔Identified gaps in decisions, communication and escalation paths
  • ✔A prioritized gap list and practical next steps

Typical investment: From $2,750 USD per virtual exercise
Hybrid and on-site variants available.

Why run an incident tabletop before something breaks?

Avoid decision paralysis

When systems are down, you don’t want leaders debating basics like “Who talks to customers?” or “Do we pay a ransom?” Practicing once in a safe environment pays off.

Spot the weak links

The exercise naturally reveals gaps in communication, approvals, technical coverage and vendor roles – without finger pointing.

Show due care to stakeholders

Boards, insurers and customers increasingly expect some level of incident planning and rehearsal. A tabletop is a pragmatic, right-sized step.

What’s included in the Incident / Ransomware Tabletop

Engagement flow
  1. Scoping call (45–60 minutes): understand your environment, critical systems and leadership personalities.
  2. Custom scenario design: build an incident storyline tuned to your size and sector (e.g. ransomware, business email compromise, SaaS outage).
  3. Tabletop session (90–120 minutes): facilitated walk-through with your leadership team and key IT stakeholders.
  4. Immediate debrief: capture observations, decisions and “we need to fix that” moments.
  5. Gap & recommendations summary: prioritized list of improvements and suggested next steps.
Who should be in the room
  • ✔CEO / President / Owner
  • ✔Finance / CFO or controller
  • ✔Operations / GM / plant or service leadership
  • ✔HR / people leader (for staff communication)
  • ✔IT lead / MSP representative
  • ✔Communications / marketing (if applicable)

From $2,750 USD per virtual exercise. On-site or hybrid formats can be scoped for larger teams or multi-location leadership groups.

Schedule a Tabletop Discussion

Good fit if...

  • ✔You have 10–500 staff and rely heavily on IT to operate.
  • ✔You don’t have a regularly rehearsed incident plan at the leadership level.
  • ✔Insurers, customers or boards are starting to ask about cyber preparedness.

Probably not a fit if...

  • You only want technical testing (e.g., penetration tests) and not leadership involvement.
  • You are looking for a legal or insurance-specific opinion rather than operational rehearsal.

Common questions

Is this technical or business-focused?

It’s primarily business-focused. We assume your MSP or IT team handles technical containment. The tabletop tests leadership decisions, communication and coordination.

Will people feel “put on the spot”?

The tone is collaborative, not “gotcha”. We create a safe environment where it’s okay to say “I’m not sure what we’d do there” – that’s the point of running the exercise.

Do you provide documentation we can show to insurers or boards?

Yes. You receive a brief written summary of the exercise, key observations and recommended next steps, which you can reference in governance discussions.

Rehearse your worst day now, not live in front of customers.

A single tabletop can dramatically improve how your leadership team responds under pressure.

Book Intro Call