Tabletop Exercises for Cyber-Physical Incidents: What Most Teams Get Wrong

A tabletop exercise that only walks through a clean incident misses the point — the real value is in forcing the cross-team decisions that were never actually rehearsed together.

The Exercise That Only Tests the Easy Part

Many tabletop exercises walk through a clean, well-behaved incident: a phishing email is reported, IT isolates a laptop, the story ends. That's a useful drill, but it rarely resembles what a cyber-physical incident actually looks like — where a digital compromise has already started affecting a physical process before anyone in the room agrees on what's happening.

Where the Real Gaps Show Up

The exercises that reveal something useful are the ones that force cross-team decisions under ambiguity: does the plant keep running while the incident response team investigates, or does someone have the authority to halt a line based on a suspicion that hasn't been confirmed yet? Most organizations discover, mid-exercise, that nobody actually has a clear answer.

Testing the Handoffs, Not Just the Playbook

A tabletop exercise's real value isn't in confirming the playbook reads well — it's in exposing the handoffs between IT, OT, safety, and operations teams that were never actually rehearsed together. Those are exactly the seams where a real incident gets slower and more dangerous.

Practiced, Not Just Documented

We run these exercises specifically to surface the decision nobody wants to make in the room, on paper, before it has to be made for real, under pressure, on the floor.