Ransomware & Incident Response·Updated 2026-10-21

What is a cybersecurity tabletop exercise?

Short answer

A tabletop exercise is a discussion-based rehearsal where the team walks through a realistic incident scenario, such as ransomware or a fake invoice payment, and talks through who does what. It tests the plan and contacts without touching real systems.

The details

An hour once a year is enough to expose missing phone numbers, unclear decision rights and untested backups.

What to do

Pick one realistic scenario.
Invite the people who would really be involved.
Reveal the scenario in stages and ask what each person does.
Record gaps and fix the plan afterwards.

Terms explained

Incident response: Incident response is the organized process of preparing for, detecting, containing, eradicating and recovering from security incidents, then learning from them.
Ransomware: Ransomware is malware that encrypts or steals data and demands payment to restore access or prevent publication.

Sources

NIST SP 800-61 Rev. 3 Incident Response