Tabletop Exercises

Security is often intuitively conceptualised as preventing attacks completely. But what happens when perfect security fails? If your organisation suffered an attack tomorrow, how would you respond? Who would make decisions? Who would contact clients? Who would speak to the media? Would you shut down systems? Would you pay a ransom? How would you determine what had happened? These questions are difficult to answer during a real crisis. Tabletop exercises are designed to answer them beforehand.

A tabletop exercise is a guided simulation of a realistic security incident. Rather than attacking your organisation's systems, we instead walk key decision-makers through a hypothetical scenario and explore how they would respond as events unfold. The objective is not to test technical defences, but rather to test preparedness, decision-making, communication, and organisational processes.

Tabletop exercises are widely used by large enterprises, government organisations, and critical infrastructure operators. However, organisations of any size can benefit from understanding how they would respond to a serious incident before one occurs.

How Tabletop Exercises Work

In a typical Tabletop Exercise service, Shellhex acts as facilitator and scenario controller. Participants are presented with a realistic scenario and a series of developments that unfold over the course of the exercise.

Pick your scenario:

Your organisation receives reports that staff can no longer access key systems. Investigation reveals that several servers have been encrypted by ransomware. A note appears demanding payment in cryptocurrency.

Do you disconnect systems from the network?

Do you notify clients?

Do you involve law enforcement?

Do you have usable backups?

Who has authority to make these decisions?

As participants make decisions, additional information and developments are introduced. This enables us to explore how existing plans, procedures, and organisational structures perform under realistic conditions.

Tabletop Exercise Results

Our tabletop exercises are designed to identify weaknesses in preparedness before a real incident occurs. The value of a tabletop exercise lies both in the experience gained during the exercise itself, as well as in our retrospective assessment of the exercise after its completion.

During the exercise, participants develop confidence and familiarity with incident response procedures, while organisational leadership gains insight into how existing processes perform in practice. Organisations can easily be surprised by how many flaws in assumptions about roles, processes, and incident response are revealed during a realistic exercise.

After the exercise is complete, we will write a report on the exercise that discusses topics such as:

  • Evaluation of incident response procedures.
  • Identification of gaps in communication processes.
  • Review of decision-making responsibilities and authority structures.
  • Assessment of business continuity and recovery planning.

We may then offer a further consultation meeting to discuss possible technical remediations, further staff training, or adjustments to operational processes in light of the information gleaned from the exercise.

Scenario Design

Every organisation faces different threats. We therefore tailor tabletop exercise scenarios to your organisation's specific circumstances. Scenarios draw on our knowledge of real-world attacks and standard attack methodologies. Specific scenarios may be based on a wide variety of possible attack methodologies, such as:

  • Ransomware attacks.
  • Data breaches.
  • Business email compromise.
  • Supply chain compromises.
  • Insider threats.
  • Cloud service outages.
  • Physical security incidents.
  • Industry-specific threats relevant to your organisation.

Pricing

Standard Tabletop Exercise

Price: £2,500 exclusive of VAT

Includes scenario preparation, one facilitated exercise session, written findings, and an optional follow-up discussion.

Comprehensive Incident Readiness Exercise

Price: From £6,000 exclusive of VAT

For organisations seeking more extensive preparedness testing. These engagements may involve multiple exercise sessions, more complex scenarios, larger participating groups, and more detailed reporting and recommendations.