Services

Tabletop Exercises (TTX)

Tabletop Exercises (TTX) are simulated cybersecurity crisis scenarios conducted as discussions and workshops around a table (or online), where a company team practices responding to a fictional incident, such as ransomware or a data leak. Led by external experts, they help identify weak points in plans and communication without risk to real systems.

What are TTX tabletop exercises?
TTX are non‑technical practical workshops focused on processes, roles, and decisions during an IT/cyber crisis. A group (management, IT, PR, legal) discusses the response to a scenario step by step, testing procedures, RACI, and internal/external communication.

What does a typical TTX look like?
Preparation (1‑2 weeks): company analysis, building a realistic scenario (e.g., ERP attack, DDoS, mass phishing), inviting participants (10‑20 people).
Workshop (4‑8 hours): the moderator presents the incident in stages ("hour 0: alert", "hour 4: escalation", "day 2: media"), the team discusses decisions, tasks, and barriers.
Debriefing (1‑2 hours): analysis of strengths/weaknesses, identification of gaps in plans, priorities for improvements.
Report (3‑5 days): a detailed document with gaps, recommendations, an improved response plan template, and an action schedule.
Follow‑up: optional TTX v2 after 6‑12 months with progress verification.

Business benefits of TTX as a service
Testing plans without the cost of a real incident – revealing holes in procedures, roles, and communication before an actual attack occurs.
Strengthening cross‑departmental coordination – management, IT, HR, and legal learn to collaborate under time pressure and stress.
Shortening response time – exercises improve MTTR (mean time to respond) by up to 50%, crucial for minimizing losses.
Regulatory compliance – TTX meets the requirements of NIS2, KSC, ISO 22301; documentation ready for audits.
Building awareness and confidence – the team gains "dry‑run" experience, reducing panic and errors in a real crisis.

Why choose a professional external company?
Internal exercises lack objectivity, scenario realism, and experience from dozens of incidents. Experts design scenarios based on current threat intel, moderate impartially, and provide benchmarks and a report with metrics, which strategically increases the value of the exercise.