1. An update arrives
The technical team reports in the way they actually would: incident declared, initial findings, findings that change. No log files. Just what leadership would hear.
The Technical Team Is Pretty Sure It Is Bad. When Do You Expect to Be Told?
A Tabletop Tuesday demo: the executive tabletop, three decision points, one room vote each
Same incident as our technical tabletop, seen from the leadership table. You get updates from the technical team as they come in, and at each decision point the whole room votes. Everyone. Then we look at who chose what, and we fix the plan.
How the Executive Session Runs
Most executive tabletops let one person answer each question: the insurance question goes to counsel, the comms question goes to marketing, and everyone else waits. We do it differently.
2. Everyone votes
Each decision point is a live poll. The CMO votes on the insurance question. The CHRO votes on board notification. Nobody defers to the "owner" of the topic.
3. The room sees the split
Results go up by person, not just by percentage. When the CEO and CFO expect to be told at different times, that is a finding, and it comes out in the room instead of at 2 a.m.
4. The plan changes live
We talk through the stronger answer, check it against the incident response plan, and write the update in the session with an owner and a date.
Two Tracks, One Scenario
The executive session picks up where the technical session leaves off. Most clients run both, a week apart, and the technical team's findings become the executive team's updates.
Executive Tabletop
CEO, CFO, General Counsel, board or audit committee
- Updates from the technical team, not injects
- Decision points with a room vote at each one
- Measured on decision clarity with incomplete facts
- 60 to 75 minutes, 3 to 4 decision points, plan updated live
Technical Tabletop
SOC, IT ops, security engineering, platform teams
- Injects are alerts, logs, and tool output
- Decisions are containment, scoping, and evidence
- Measured on speed to contain and the hand-off upward
- 90 minutes, 5 to 7 injects, 15-minute decision clock
Run This With Your Leadership Team
Every Tabletop Tuesday scenario is built from a real incident pattern we have worked. We facilitate, your executives decide, and you leave with a plan that has been changed, not just reviewed.