The tabletop exercise platform that fights back.
A tabletop exercise is only as good as the pressure it creates. Verdus Cyber replaces the slide deck with a live, escalating incident (injects, ringing phones, regulator deadlines) and scores every decision your team makes.
What is a cyber tabletop exercise?
A cyber tabletop exercise (TTX) is a structured rehearsal of a severe cyber incident: the crisis team works through a realistic scenario (ransomware, data extortion, OT outage), making the decisions they would have to make on the real day, without touching production systems. The goal is not to test firewalls; it is to test people, roles, decision paths and communication under uncertainty.
Regulators and standards treat exercises as core evidence of preparedness: NIS2 and national implementations expect business continuity and crisis management to be practised, DORA requires scenario-based testing in the financial sector, and frameworks from ISO 27001 to BSI-Standard 200-4 assume incidents are rehearsed, not just documented.
Why slide-deck tabletops fail quietly.
No clock, no pressure
A moderated discussion pauses whenever it gets uncomfortable. Real incidents don't. Without a running clock, nobody learns how decisions feel at speed.
The loudest voice wins
Around a conference table, seniority substitutes for process. On the real day, the process has to carry, especially when key people are unreachable.
Nothing is captured
A flipchart photo is not evidence. If decisions aren't timestamped and scored, the exercise produces a feeling, not a finding, and nothing to show a regulator, auditor or board.
What a tabletop exercise platform must do.
If a tool can't do these six things, it's a presentation, not an exercise platform.
- Live, sequenced injects that escalate on a running clock, and react to what the team decides
- Multi-channel pressure: mail, calls, news, chat and regulator deadlines arriving in parallel
- Decision capture with timestamps: who decided what, when, on which information
- Framework-mapped scoring (NIST CSF, ISO 27001, MITRE ATT&CK, DORA, NIS2) instead of gut feeling
- Repeatability: the same scenario, re-run months later, with comparable results
- Evidence export the board, auditor or supervisor can actually use
Slides, DR tooling, or an exercise platform?
Different tools solve different problems. This is where each one is honest work, and where it stops.
| Slide-based TTX | DR/BC tooling | Verdus Cyber | |
|---|---|---|---|
| Time pressure | None: pauses on demand | Technical runbooks, no crisis clock | Running clock, escalating injects |
| Decision capture | Flipchart & memory | Ticket trails, tech-only | Timestamped, per decision |
| Executive involvement | Passive listening | Rarely designed for the board | Decision prompts built for leadership |
| Scoring | Facilitator's impression | RTO/RPO metrics | Eight competencies, framework-mapped |
| Repeatability | New workshop each time | High for failover tests | Same scenario, comparable re-runs |
| Best at | First awareness session | Proving systems recover | Proving people and decisions hold |
From scoping to re-test in five steps.
Scope
Pick a sector scenario or co-design one around your real threat model, stakeholders and obligations.
Tune
Adjust injects, difficulty and reporting duties: DORA clocks for a bank, NIS2 chains for an operator.
Run live
Your team works the incident in the browser while a facilitator drives pressure from the controller seat.
Debrief
Walk the timestamped timeline, surface the decision points, score against the frameworks that matter to you.
Re-test
Fix what the evidence showed, then run it again and prove the delta.
What buyers ask first.
How long does a tabletop exercise take?
A focused run takes 2–4 hours including the hot wash; a full executive debrief adds about an hour. Most teams schedule half a day.
How many people should take part?
Five to twelve works best: crisis lead, IT/SOC, communications, legal/data protection and at least one executive decision-maker. Larger groups split into exercise and observer roles.
Does it work remotely?
Yes, the exercise runs in the browser, so distributed crisis teams train exactly the way they would actually respond: from wherever they are.
What do participants need installed?
Nothing. A current browser is the entire technical requirement: no agent, no VPN, no access to your production systems.
How is this different from the free simulation?
The free simulation is a single-player taste of the pressure. A facilitated exercise runs your whole team against a scenario tuned to your organisation, with a scored debrief and evidence export.