We met Matias Sliafertas and Federico Pacheco at 2025 TF-CSIRT Meeting & FIRST Regional Symposium Europe where they led an interactive workshop on cybersecurity tabletop exercises (TTXs) which guided the participants through the comprehensive design and execution of TTXs tailored for both executive (C-level) and technical teams. We invited both of them to share their tips and tricks on designing an interactive and realistic TTX for an organisation.

A good tabletop exercise (TTX) should be built on a clear structure, realistic context, and measurable objectives. Based on our published methodologies and practical experience, the “recipe” begins with a well-defined goal and scope, because every design decision must derive from what the organization needs to validate, improve or learn.

A solid TTX combines:

1. Explicit objectives and scope.
2. Realistic scenarios, aligned with the organization’s risks, assets, and industry threats, all together need to make a realistic story.
3. A coherent and technically consistent storyline, enriched with MITRE ATT&CK-based TTPs when appropriate , and of course you can argue that always a new zero-day can appear but try to don’t use that wildcard for everything. 
4. Clear roles and responsibilities for players, coordinators and observers.
5. A structure that enables measurable outcomes, such as through the ENISA–NIST parameter-mapping model we developed for quantifying improvements.

Yes, absolutely, and the distinction is essential. Management teams and operational/technicals teams face different cognitive and procedural challenges, so the exercises must reflect that. Management should be focused in a more crisis-oriented exercise, emphasizing the strategic view, decision-making, communications internally and externally, legal and of course business impact and possible strategies. When we design the inject for this audience, we always try to include ambiguity, incomplete information, and external pressure in order to exercise how to make the right questions, how to reach the right team and of course practice decision-making showing potential impacts. We generally focus on reputation, regulatory exposure, and collateral effects (e.g., media, customers, shareholders).
On the other hand, a more operational or technical exercises should emphasize detection, analysis, containment, forensics, and of course remediation. We use technically grounded injects (logs, alerts, third-party notifications) and follow an attack chain supported by MITRE ATT&CK-based TTPs.

Initiation varies depending on maturity, structure, and regulatory context of each company, but it almost always comes from a function responsible for risk, business continuity, cybersecurity or information security, or compliance. However, we had occasions when we were contacted by HR or the top management directly.