- Home
- Offensive Security & Hunting
- Tabletop exercises
A plan nobody has rehearsed
is only a document.
We write incident response playbooks for your tools, team and regulators, then test them in a Vigriðr tabletop exercise so the gaps surface in a meeting room rather than a real incident.
Playbooks, then proof they work.
Many incident response plans sit in a shared drive until the day they are needed, when the roles turn out to be unclear, the contact list is out of date and nobody has practised the steps. We fix both halves: we write the playbooks your organization needs, then we test them with the people who will use them.
A Vigriðr tabletop exercise is a facilitated discussion. Your responders, managers, legal, communications and executives walk through a realistic scenario while our facilitators add injects and complications. It is quick to run and ideal for checking roles, decisions and communications. If you want to see what your team does against real malware, that is a cyber war game.
- Incident-type playbooks: ransomware, phishing, BEC, insider threat, data breach and more
- Roles and responsibilities for every phase of response
- Decision trees, escalation criteria and evidence-preservation checklists
- Communication templates for staff, customers, regulators and insurers
- A facilitated tabletop exercise built around your playbooks
- An after-action report with fixes, and updated playbooks
Interview, write, exercise, refine.
Interview and review
We talk to your stakeholders and review your current plan, tools, team structure and notification obligations.
Write the playbooks
Step-by-step procedures for each incident type, tied to your actual SIEM, EDR and ticketing, with verified contacts and escalation paths.
Run the tabletop
A facilitated scenario with injects that escalate, tailored to the audience: technical for responders, strategic for leadership.
Refine
We update the playbooks where the exercise showed they broke down, and deliver an after-action report.
Drawn from incidents we have handled.
Each scenario is adapted to your industry, technology and regulatory obligations.
- Ransomware, from initial access to recovery decisions
- Data breach with personal or health information exposed
- Business email compromise and payment fraud
- Insider threat and intellectual property theft
- Supply chain compromise through a vendor or software update
- Cloud identity takeover
- OT and ICS incidents with safety implications
Two ways to test, for different questions.
| Vigriðr tabletop | Vigriðr war game | |
|---|---|---|
| Format | Facilitated discussion | Live exercise in a replica environment |
| Malware | None, scenario injects only | Real ransomware, isolated from production |
| Best for | Roles, decisions, communications, playbook gaps | What your team actually does under pressure |
| Effort | Lighter to set up and run | Requires a replica of your environment |
Who it is for
Organizations with no written incident response playbooks, or with a plan nobody has tested. Also regulated teams who need evidence of an exercise for auditors, insurers or the board.
- Cyber war gaming, the same plan, tested against real malware
- IR retainer, the team your playbooks call first
- Crisis management, command structure and communications
- Ransomware readiness, score the controls behind the plan
What buyers ask.
We already have an incident response plan.
Good. We start from it. The question is whether the people named in it know their steps and whether the steps still match your tools. A tabletop answers that in an afternoon.
What is the difference between this and war gaming?
A tabletop is a facilitated discussion: no malware, no replica, just your team working through a scenario. War gaming runs real ransomware in a copy of your environment. Many clients start with a tabletop and move to a war game.
Are these generic templates with our logo on them?
No. Playbooks are written for your tools, your team structure and your notification obligations, by responders who have handled these incidents.
Who needs to attend?
It depends on the scenario. Technical exercises focus on responders and IT operations. Leadership exercises bring in executives, legal, communications and HR. We help you choose the room.
Test the plan before you need it.
Put an engineer on a call to scope playbooks and a Vigriðr tabletop for your team. No charge, no commitment.