Tabletop exercises test how well a team or process works by simulating a situation and acting out the planned response action and they have long been a valuable tool to prepare for adverse scenarios.

The military runs tabletop exercises to experiment with different strategies in conflict situations while governments use them to improve response to crises. Within organizations, tabletop exercises are an effective way to prepare for cyberattacks.

This guide explains what security tabletop exercises are and how to run them. It is based on the approach that is used by the Sophos Cybersecurity team to prepare our own organization for an attack.