Tabletops that actually work

The point of a tabletop is not to confirm that the plan exists. It is to find the decisions leadership will have to make under pressure — and rehearse them with the actual people who will make them.

What good tabletops have in common

• A scenario that matches the organization's actual threat profile, not a generic ransomware story
• The real people in the real roles — not their delegates
• Decision points that force trade-offs, not just process checks
• A facilitator who is willing to make the room uncomfortable

A tabletop that ends with everyone agreeing the plan is fine has wasted everyone's time. The point is to surface the gaps — and then close them before they get tested for real.