Blog
Blog
-
They wrote freeze. The migrate job was still running.
At 02:19 run 1844221 of migrate-prod.yml is still applying 20261019_invoice_index to prod-db-01. Priya calls it a copy change. The scribe writes that the freeze is in effect.
-
They wrote no evidence. The log said 200.
At 03:06 Priya reads a 200 on customers/2026-10-18.csv from 01:40 UTC. The key is still Active. Marcus waits for a full inventory. The scribe writes that there is no evidence.
-
The bridge stayed in Slack
At 02:26 a guest session is in #incident-bridge. The plan says leave Slack. Marcus stays because the thread scrolls. The scribe writes that comms moved out of band.
-
They wrote rebuilt. Nobody had an image.
At 02:34 Priya says she would terminate prod-payments-01. The scribe writes that it was rebuilt from a clean image. Harbor IR was never called, and the volume would have come back on the replacement.
-
The trigger said Sev 1. The room said Sev 2.
At 02:14 the EDR flags encryption on prod-payments-01. The plan says that is Sev 1 even while authorizations are still succeeding. Priya calls it Sev 2. The packet has to keep both grades.
-
The break-glass item wants Okta
At 02:18 a leaked deploy key is listing secrets. The plan says use break-glass. The vault item asks for Okta, and the plan also says not to trust Okta. Record the path you could not open.
-
The day-after file is not the tabletop
At 14:22 Dana drafts a holding statement for a reporter. The file calls it a catastrophic cyber exercise. In March an assessor asks who isolated prod-payments-01. How to keep that rehearsal from standing in for the tabletop.
-
The summary said backup. The alert said encryption.
At 02:14 the triage assistant told on-call to restore prod-db-01 from a November 2024 playbook. The raw alert was encryption. How to plant that summary in a tabletop and record whether anyone opened the alert.
-
The report went to a mailbox: practise the intake for outside breach disclosures
A vendor's AI agent reached an Australian government portal in June, and the disclosure arrived by email in September. How to exercise the intake: who reads it, who owns the reply, and what the packet timestamps.
-
When not to run a tabletop
A conversation cannot produce a restore time, a detection proof, or a named commander the plan never had. Match the tool to the question before you book the room.
-
Twelve on the call is not attendance
A Zoom participant count hides empty seats. How to run a visible clock, take attendance by role, and treat a muted required seat as a finding.
-
If they have to open Slack, the packet is not done
Chat threads and Drive links are not a tabletop record. What has to live in the file so an assessor can sample the exercise without you.
-
The ransom note is a decision. The restore is a test.
On 29 September, more than 100 people from 40 Alabama water utilities ran a tabletop on the Cahaba. How to keep the ransom-note calls in the room and put the restore of prod-db-01 on a different day.
-
Practice the customer notice. Do not send it.
The filing clock and the customer clock are different decisions. How to draft the notice, time who would approve it, and keep the live send off the exercise.
-
The decision nobody wrote down
A hospital tabletop this week found a call the room had already made and nobody had recorded. How to write plan-says versus room-did, the same way Cyber Storm X will write its after-action.
-
Write injects that force a decision, not a discussion
Most tabletops fail at the inject. How to write a timed prompt that names a system, a seat, and a choice, and what a vague prompt costs when someone later reads the packet.
-
Who files at hour 72: what Cyber Storm X is actually testing
CISA's Cyber Storm X is four days of live play for about 2,000 operators. The part every IR team can steal is the reporting clock: who starts it, who files, and what the room still does not know.
-
The goal is not to pass or fail: what recent IR workshops get right
Microsoft DART and a bank tabletop both stressed practicing IR decisions under pressure without grading the room. How to take that stance into your own evidence packet.
-
When an AI agent acts off-script: what an IR tabletop should practice
Recent public reports of evaluation agents taking unsanctioned live-internet actions give IR teams a concrete scenario family. What belongs in a tabletop, and what still needs a technical test.
-
Who to invite to an IR tabletop (roles beat titles)
Build the invite list from the roles your IR plan names, not the org chart. How an empty seat becomes a finding, and how to record it without grading anyone.
-
SOC 2 incident-response tabletops: what an auditor actually expects
What SOC 2 asks for on incident response readiness, what evidence looks like, and what a tabletop proves (and does not prove) when you hand the packet to an auditor.
-
How to run an annual AI-incident tabletop (and why your policy may now require one)
AI governance policies increasingly call for annual incident exercises. What an AI-incident tabletop covers, how to run one, and why it is not adversarial or pen testing.
-
A tabletop is not a DR test: what each one proves
Honest distinction between a BC/DR tabletop and a live failover or restore test: what each proves, where each helps, and why you still need both in a serious program.
Notes from running facilitated tabletop exercises and writing the evidence afterwards. RSS