Tabletop Exercises & Incident Readiness
Because the worst time to write your incident response plan is during the incident.
A cyber incident doesn't ask whether you're ready. Ransomware lands at 2 a.m. on a long weekend. A vendor calls to tell you their breach has become your breach. An employee posts something to ChatGPT they shouldn't have. The clock starts the moment it starts — and the decisions you make in the first six hours determine whether the next six months are a recovery or a reckoning.
Most organizations have an incident response plan. Very few have ever tested it under pressure.
That's what we do.
What a Magenta tabletop looks like
A Magenta tabletop is a structured, facilitated exercise that puts your executives, legal counsel, communications lead, IT and security leadership, and — where appropriate — your board representatives in the same room. We walk you through a custom scenario, injecting twists and complications the way a real incident would, and we make you decide. Out loud. Together. Against the clock.
We're not there to embarrass anyone. We're there to surface the things that look fine on paper and fall apart under pressure: the escalation path nobody remembers, the legal threshold nobody understands, the comms holding statement nobody has actually approved, the third-party contact list nobody has updated.
By the end of the session, you'll know — concretely — where your plan holds and where it breaks. And you'll have a roadmap to fix it.
Our methodology
Step 01
Step 02
Step 03
Step 04
Scenario types we facilitate
We build every scenario custom, but they generally fall into one of these categories:
Ransomware — encryption events, double-extortion, payment-decision dynamics
Insider threat — malicious, negligent, and compromised insiders
Third-party and supply chain compromise — vendor breach, MSP compromise, software supply chain
AI-enabled attacks and AI misuse — deepfake-driven social engineering, prompt injection, data leakage through AI tools, AI-generated phishing at scale
Physical and converged security — incidents that cross digital and physical boundaries
Nation-state and politically motivated threats — for organizations with elevated threat profiles
Sector-specific scenarios — healthcare clinical disruption, financial-services regulatory triggers, public-sector service-delivery impact, manufacturing operational technology
Scoping & Scenario Design
We start with a working session to understand your sector, your threat profile, your existing plans, and the audience the exercise needs to serve. From there, we build a custom scenario grounded in current threat intelligence — the techniques real attackers are using, the regulatory and reporting obligations you'd actually face, and the operational realities of your environment.
Facilitation
On exercise day, we run the room. A lead facilitator guides the scenario, injects complications, manages timing, and keeps the discussion focused. A second team member observes, documents decisions, and tracks where the plan held and where it strained. Sessions typically run 2–4 hours for executive tabletops, longer for technical or hybrid formats.
After-Action Report
Within two to three weeks, you receive a formal After-Action Report — a structured document mapped to NIST Cybersecurity Framework 2.0, identifying what went well, what didn't, and what to do about it. Every recommendation is prioritized, owner-assignable, and written to be defensible if a regulator, auditor, or board member ever asks how you knew where your gaps were.
Follow-Through (optional)
Most organizations leave a tabletop with more work to do. We can help you close the gaps — whether that's revising the incident response plan, building runbooks, training the team, or running the exercise again in 12 months to measure improvement.
Who this is for
Public sector bodies running mandatory incident response readiness exercises, demonstrating governance to oversight bodies, or preparing for an audit cycle that includes cyber.
Small and mid-sized businesses that have an incident response plan because their cyber insurer or a major customer required one — and have never actually pressure-tested it.
Non-profit and healthcare organizations balancing tight budgets against rising threats, who need a structured way to show their boards that cyber risk is being actively managed.
Growing companies approaching SOC 2, ISO 27001, HIPAA, or other certification cycles where tabletop exercises are required evidence.
Any leadership team that has had a near-miss, watched a peer organization get breached, or simply looked at the news and asked: would we know what to do?
What you walk away with
A custom scenario tailored to your organization, retained as a reusable training asset
A facilitated executive-level exercise that builds genuine readiness — not just compliance evidence
A formal After-Action Report mapped to NIST CSF 2.0
A prioritized, owner-assignable list of recommendations
Documentation defensible under audit, regulatory review, or board scrutiny
A leadership team that has now made these decisions together, before they ever had to
Why Magenta for tabletops
Tabletop exercises only work if the facilitator has actually been in the room when real incidents happen. We have. Our team has worked at the operations level and at the executive table, across healthcare, government, manufacturing, telecommunications, and growth-stage companies.
We don't run pre-canned exercises out of a binder. Every scenario is custom. A senior practitioner leads every facilitation. Every After-Action Report is written to a standard you can put in front of a regulator without flinching.
Most organizations leave a tabletop with follow-up work. If you need someone to own that roadmap ongoing, see Fractional CISO & Cybersecurity Strategy.
