Tabletop Exercises and Drills

You do not rise to the occasion; you fall to the level of your training. The tabletop exercise is how you raise that floor. It is a facilitated, discussion-based rehearsal of an incident -- no production systems touched -- where the people who would actually respond walk through their decisions against a scenario that unfolds in stages. Done well, it exposes the gaps in your plan before an adversary does. Done as theater, it wastes an afternoon and certifies false confidence.

Design the scenario against your real threat model. For AI infrastructure the high-value tabletops are specific: ransomware detonates in the orchestration plane during a training run; an intruder pivots from an engineering laptop into the building-management system and begins manipulating the cooling loop; model weights are being exfiltrated through an authorized-looking transfer; a vendor's remote-access account is compromised and used to touch the power train. Pick one. Ground it in your actual architecture, your actual vendors, your actual segmentation. A generic scenario produces generic lessons; a specific one finds the bridge between your operational-technology and IT networks that nobody documented.

Structure the exercise around injects. An inject is a piece of new information delivered at a set point -- an alert, a ransom note, a call from a regulator, a journalist asking about an outage, a report that the backups are also encrypted. Injects drive the scenario forward and force decisions under mounting pressure. Sequence them to escalate: begin with ambiguity (an odd anomaly, is it even an incident?), force the declaration decision, then pile on the complications that stress your assumptions -- the primary responder is unreachable, the containment action would trip the cooling loop, the breach clock has started and legal is not in the room. The pressure is the point. You are testing decisions, authorities, and communication, not trivia.

Put the right people in the room and give them their real roles. The incident commander runs the response. The operations-center lead speaks to detection and forensics. A control-systems engineer speaks to what can and cannot be safely done to the plant. Legal and compliance speak to breach-reporting obligations and the clock. Communications speaks to customers, staff, and press. An executive with actual decision authority is present for the calls that exceed the commander's mandate. Cross-functional presence is the whole value: the tabletop is often the first time the IT responders and the facilities engineers have ever planned a response together, and the misalignment they discover -- different tools, different vocabularies, different chains of command -- is exactly the finding you want surfaced in a conference room rather than at 3 a.m.

A facilitator runs the exercise and a scribe records it. The facilitator delivers injects, keeps the discussion honest (you say you would isolate that segment -- walk me through exactly how, and what breaks when you do), and resists the urge to let the team narrate a happy path. The scribe captures decisions, assumptions, and -- most valuable -- every moment someone says I assumed that team handled it or I don't know who owns that. Those gaps are the deliverable.

Measure the exercise; do not just hold it. Capture concrete metrics: how long until the incident was declared, whether the team could locate the current playbook, whether they knew the breach-reporting clock and who starts it, whether pre-authorized containment actions were understood, whether anyone could name who has authority to stop work on the plant. Every gap becomes an action item with an owner and a due date, and the next exercise verifies the fix. An exercise that generates no changes was theater.

Build a cadence and climb a ladder. Tabletops are the discussion tier. Above them sit functional drills -- actually failing over a system, actually restoring from backup, actually testing the out-of-band communications -- and above those, full-scale exercises that combine live technical response with the decision-making of the tabletop. Run tabletops quarterly, rotate the scenarios across the converged surface so operational technology and physical compromise get exercised as often as ransomware, and pull in your critical vendors for the scenarios that involve them. The threats evolve, the staff turns over, and the plan drifts from reality between rehearsals. The organization that rehearses the converged incident on a schedule is the one that executes the lifecycle under real pressure -- because it has fallen to a level of training it deliberately raised.