Tabletop Exercise Services Buyer's Guide

A tabletop exercise that leaves everyone comfortable has usually tested nothing, and the difference between a useful exercise and an expensive meeting is mostly decided when you choose who designs and runs it. Organisations buy tabletop exercises because a regulator, insurer, auditor or board asked for evidence of incident readiness, or because a peer's incident showed how unprepared leadership would be. The market splits into facilitated services, where consultants design and run the session, and exercise platforms, which supply scenarios, injects and reporting for teams to run themselves. This vendor-neutral guide is for security, resilience and risk leads choosing between them and comparing providers. How to design and run an exercise is covered in our Tabletop Exercise Guide; this page is about buying the service.

Key takeaways

Start from objectives, not scenarios. Decide which decisions, plans and people you want to test, then judge providers on how they turn those into injects and evaluation criteria.
Realism comes from your environment. A scenario built on your own systems, suppliers, identities and contracts teaches more than a polished generic ransomware story.
Executives need a different exercise. Board and executive sessions test decisions, communication and legal judgement; technical sessions test procedures. Few providers do both equally well.
The after action report is the product. Buy findings with owners, dates and evidence that feed your improvement plan, not a slide deck of observations.
Free government packages set the baseline. CISA and the UK NCSC publish exercise materials at no cost, so a paid provider must add design, facilitation or evaluation value beyond them.

Define requirements

Purpose and audience: board, executive committee, crisis team, incident response team, IT operations or a mix. Write one sentence per audience on what success looks like.
Plans under test: the incident response plan, crisis management plan, ransomware playbook, communications plan, business continuity plans and any supplier escalation routes. Providers should read them before designing. See the Incident Response Plan Template.
Drivers and evidence: note which regulator, auditor, insurer or customer expects exercise evidence and in what form, so the report meets it first time. NIST CSF 2.0 outcome ID.IM-02 expects improvements to be identified from tests and exercises, and NIST SP 800-53 Rev. 5 includes IR-3 Incident Response Testing and CP-4 Contingency Plan Testing.
Format: in person, remote or hybrid; one session or a programme across the year; facilitated, self-run on a platform, or both.
Scenario themes: the threats in your risk register, such as ransomware, identity provider compromise, supplier breach, data theft and extortion, insider misuse or AI agent misuse. See the Tabletop Exercise Scenario Pack.
Confidentiality: exercise materials describe your weaknesses. Decide who may see them and whether the work is commissioned through counsel.

Size changes the answer. A small organisation can run a credible first exercise with free government materials and an internal facilitator, and buy facilitation only for the executive session. A large or regulated organisation running several exercises a year often combines a facilitated annual executive exercise with a platform for frequent team-level sessions and tracking actions.

Facilitated service or platform

Model	Best for	Strengths	Limits to test
Facilitated, bespoke	Board and executive exercises, first exercise after a major change, regulatory evidence	Independent challenge, tailored scenario, experienced facilitator manages senior dynamics	Cost per session; quality depends on the named facilitator; findings may stop at the report
Facilitated, standard scenario	Teams needing a quick, credible exercise	Lower cost, proven running order	Generic injects that do not touch your systems or suppliers
Exercise platform	Frequent team exercises, distributed teams, tracking actions across exercises	Scenario library, timed injects, participant input capture, reporting and history	Needs an internal facilitator; scenario realism depends on your customisation
Free government packages	Small organisations, first exercises, internal facilitators	No cost; CISA offers over 100 Tabletop Exercise Packages and NCSC Exercise in a Box offers 20 exercises across 12 topics	Generic by design; you supply facilitation and evaluation

Exercises beyond discussion, such as functional and full-scale simulations, are covered in the Cyber Incident Exercises Beyond Tabletop Guide.

Capability areas

Scenario design: research into your environment, threat intelligence relevant to your sector, and injects that force real decisions such as paying a ransom, shutting down a business system, notifying a regulator or disabling a compromised identity provider.
Facilitation: keeping senior participants on task, drawing in quieter voices, managing time and pressure, and handling sensitive topics without blame.
Executive and board content: legal, regulatory and communication decisions, media and customer handling, and decisions under uncertainty. See the Crisis Management Guide.
Technical depth: for response teams, injects grounded in real logs, alerts and tooling decisions, including identity containment such as revoking tokens and rotating service account credentials.
Evaluation: observers or evaluators scoring against agreed objectives, capturing timings and decisions, not only discussion notes.
After action output: a report with strengths, gaps, root causes and an improvement plan with owners and dates. See the Tabletop Exercise After Action Report Template.
Platform features (if self-run): scenario authoring, timed and conditional injects, role-based views, remote participation, action tracking across exercises, and export of evidence.

Evaluation criteria

An illustrative weighting: 30% scenario realism and design, 25% facilitator quality, 20% after action output, 15% security and confidentiality, 10% commercial terms.

Criterion	What good looks like	Weak signs
Discovery effort	Reads your plans, interviews stakeholders, reviews recent incidents before designing	Scenario chosen from a catalogue on the first call
Scenario realism	Uses your systems, suppliers, contracts, regulators and identity architecture; injects escalate and branch on decisions	Linear storyline that runs the same whatever participants decide
Facilitator	Named facilitator with incident response or crisis experience at the right seniority; references from comparable exercises	Facilitator assigned after signature
Executive handling	Board session focused on decisions and accountability, shorter, with legal and communications injects	Technical exercise repeated for executives
Evaluation method	Objectives agreed in advance, dedicated observers, timings recorded	Findings written from memory after the session
Report quality	Findings mapped to plans, owners, dates and priority; suitable as audit evidence	Generic recommendations; no improvement plan
Follow-through	Retest of key actions, progress check, programme across the year	One-off session with no link to the next
Confidentiality	Materials stored securely, access limited, deletion on request; platform with SSO, MFA and audit logs	Scenario files emailed widely; shared platform accounts
Pricing	Clear price per design, session, report and retest; platform priced by users or exercises with export included	Hidden charges for customisation, reports or data export

Questions to ask vendors

What will you read and whom will you interview before designing the scenario, and how long does discovery take?
How do injects change when participants make different decisions? Show an example decision tree.
Who will facilitate our session, what incidents or crises have they handled, and can we speak to a past client of theirs?
How do you run a board session differently from a technical one, and how long should each be?
How are observations captured during the exercise, and who evaluates against our objectives?
Can you show a redacted after action report and improvement plan from a comparable exercise?
How do you handle our scenario materials and findings, and where are they stored?
For platforms: what authentication options, audit logging and data export do you provide, and can we author our own scenarios?
What do you add beyond the free CISA and NCSC exercise packages?

Red flags

A fixed scenario that does not change after discovery, or no discovery at all.
Exercises designed to be passed, with no inject that forces a hard decision.
Scores or maturity ratings with no evidence of how participants actually performed.
A report delivered months later, or one with no owners or dates.
No difference between executive and technical formats.
A platform that keeps your exercise history but offers no export.
Upselling remediation services as the main recommendation of the after action report.

Proof of concept

Request a scenario outline: after a short discovery call, ask each shortlisted provider for a one-page scenario outline with objectives and three key injects for your environment.
Run a short pilot: a 90-minute session for one team, ideally the incident response or crisis team, before committing to an executive exercise.
Score the pilot against objectives: did the injects test the plans you named, did the facilitator manage the room, and were decisions recorded?
Review the pilot report: check it within the agreed time for owners, dates and links to your plans.
Trial the platform with your own facilitator: if self-run is planned, have an internal facilitator author and run a scenario without vendor help.
Agree the programme: set the annual calendar, the retest of key actions and how progress will be reported to the board. See the Board Cyber Risk Reporting Guide.

Measure value over the year: percentage of improvement actions closed by their due date, time to key decisions compared across exercises, number of plans updated after exercises, participation by required roles and the share of actions retested successfully.

Standards and references

How NHI Mgmt Group can help

We provide independent requirements, RFP and evaluation support. Browse vendors in our products directory or contact us.

Tabletop Exercise Services: How to choose facilitators and platforms that improve response