Tabletop Lessons from 3 Decades and 2 Continents
summary
Dataset covers 150+ exercises across two continents and shows recurring operational failures: bloated 250‑page IRPs nobody uses, missed chain‑of‑custody and late insurer notification, unclear decision authority on ransom, absent key personnel during incidents, and poor action tracking. Recommended fixes include a single incident leader, explicit repeat‑back communications, routine short drills (weekly to monthly), and simple tools like whiteboard and pen to record assigned tasks, deadlines and owners so decisions actually happen and actions are verifiable.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 5:47What we expected versus what we found
- 14:59Incident response flaws
- 21:05Procedural errors impact
- 28:08Business prioritization gaps
- 33:01Incident leader role
- 36:54Training and discipline
- 41:34Operational mindset
- 45:03Q&A
related talks
32mHow to Orchestrate a Cyber Security Incident Tabletop Exercise
49mTraining for Incident Response: The Red, the Blue, and the Ugly
28mThe CISO is Dead, Now What ?
51mLife after the Breach: A Survivor's Guide
28mBeyond Incident Reporting - An Analysis of Structured Representations for Incident Response
44mFireside chat
01h 08mBackdoors & Breaches: Live Tabletop Exercise Demo
27mArcades and Audits: What Gaming Can Do for Your Security Posture