Article | October 1, 2026

Cyber readiness through tabletop exercises

Cybersecurity tabletop exercises enable a continuous cycle of awareness, assessment, protection, exercising, recovery and improvement. Practical testing picks up where documented response plans —which may not fully reflect everything from actual escalation paths to recovery complexities — leave off.

by Gail Carr, Advisor, Americas Intelligent Cybersecurity Advisory Services, DXC Technology

In today’s threat landscape, cyber security incidents are no longer a question of if, but when. Organizations face an increasingly complex mix of cyber threats, operational dependencies and regulatory expectations as they become increasingly dependent on cloud services, third parties, interconnected platforms and AI-enabled technologies. More than ever before, a single cyber event can quickly escalate into a business crisis, disrupting operations, interrupting customer services, exposing sensitive data, affecting supply chains and causing significant reputational damage.

The ability to respond to threat actors effectively is no longer viewed as a technical capability alone. It has become a business imperative that directly impacts operational continuity, financial performance, regulatory compliance, customer trust and organizational reputation.

Readiness is critical

Many organizations have invested significantly in cybersecurity technologies and documented response plans. They’ve put resources into developing incident response, business continuity, crisis management and disaster recovery capabilities. Yet the true measure of preparedness is not whether a plan exists, but whether leaders and response teams can execute effectively when faced with a real cyber crisis.

Unfortunately, business’ plans may not fully reflect actual escalation paths, decision authorities, communication requirements or recovery complexities. Preparedness is not demonstrated through documentation alone. Readiness is proven through practice.

This Cybersecurity Awareness Month is a great time for organizations to take the opportunity to validate their ability to respond, coordinate, communicate and recover during a disruptive cyber event. They can attain the true measure of resilience — the ability to respond effectively, recover efficiently and continuously adapt to emerging threats.

Enter the tabletop exercise (TTX)

Without practical testing of response plans through cybersecurity tabletop exercises, assumptions made in planning often remain unchallenged until a real incident occurs.

Ask yourself the following questions about a single critical scenario to understand if your organization’s plans have moved beyond awareness to real-world readiness:

• How would your organization respond to a major ransomware event?
• Are executive decision authorities clearly understood?
• Could communications be effectively managed during a cyber crisis?
• Is recovery prioritized and coordinated across the business?
• Has your response capability ever been validated under realistic conditions?

If the answer to any of these questions is uncertain, a tabletop exercise for a cyber crisis simulation can help provide clarity.

A ransomware tabletop exercise helps organizations answer critical questions to that scenario, as other cybersecurity tabletop exercise scenarios do to many others — insider threats, third-party and supply chain compromises, cloud security incidents, data breaches, operational technology attacks, AI-enabled cyber threats — by providing a controlled environment for testing and interfacing before a real cyber incident places the organization under pressure.

When responding to a cyberattack of any kind, organizations must coordinate multiple functions simultaneously. This raises questions including:

• Who has authority to initiate containment actions?
• When should executive leadership be engaged?
• How are external communications managed and approved?
• What business services receive recovery priority?
• What third parties need to be involved?
• How will recovery efforts be validated before systems return to production?
• If/when do I need to inform the authorities?

Incident response tabletop exercises provide a safe and structured environment for organizations to validate assumptions and make better assessments. By simulating realistic scenarios, participants can evaluate decision-making, communication, coordination and recovery processes while identifying opportunities for improvement before a real-world incident occurs.  

Tabletop exercises for cybersecurity are not one-size-fits-all. Different audiences have distinct roles during a cyber crisis, and each should be tested through scenarios tailored to their responsibilities. Exercises may focus on:

• Executive (C-suite and board) exercises emphasize strategic decision-making, business impact, regulatory obligations, stakeholder communications and organizational risk.
• Technical exercises focus on incident response, threat containment, forensic investigation, system recovery and operational restoration.
• Enterprise-wide exercises bring together executives, IT, security, legal, human resources, communications, business operations, third-party vendors and other stakeholders to validate end-to-end crisis management and organizational resilience.

By incorporating different threat scenarios, varying levels of complexity and diverse participant groups, exercises help ensure that strategic, operational and technical capabilities are all tested and strengthened.

How DXC supports tabletop exercises

Available through DXC Intelligent Cybersecurity Advisory Services, DXC Technology's Cyberattack Tabletop Exercise approach provides customized, business-relevant scenarios that enable participants to develop confidence in their response and recovery capabilities while uncovering gaps, dependencies, and opportunities for continuous improvement.

A DXC-facilitated tabletop exercise helps:

• Leaders gain experience making high-impact decisions involving ransomware, operational disruption, legal obligations, customer impact, business continuity and recovery.
• Security, IT, legal, communications, business operations, executive leadership and third-party stakeholders develop a common operating picture and strengthen collaboration.
• Organizations evaluate not only how to restore systems, but how to recover trusted business operations while reducing the risk of reinfection or recurring compromise.
• Enterprises find unclear responsibilities, communication bottlenecks, process weaknesses, recovery challenges and hidden operational dependencies.
• Organizations translate exercise observations into measurable improvements.

Different perspectives, stronger readiness

Organizations frequently state that they already conduct tabletop exercises internally. While these efforts provide significant value — often excelling at validating existing processes and familiarizing teams with organizational procedures — cyber resilience is strengthened not only through continuous practice, but different threat scenarios, varying levels of complexity, different participant groups and diverse perspectives.

Different facilitators, such as DXC, bring unique experiences, industry insights and lessons learned from the real-world. They can provide an objective perspective by identifying hidden dependencies, governance gaps, communication challenges, recovery obstacles and risks that may have become normalized over time.

Always remember that your goal is to achieve the end game of cyber resilience. Cyber awareness builds understanding. Cyber readiness builds confidence. Cyber resilience is achieved when organizations continuously test, improve and validate their ability to respond, recover and adapt to evolving threats, with significant value gained from tabletop exercises.