Trust Center Sign in
Endpoint modulesNGAV / Malware PreventionFirewall & Firewall PolicyApp ControlDevice ControlDLPFileHunt & QuarantineFile Integrity MonitoringHost InventorySoftware Inventory / SBOMPatch ManagementExposure ManagementExposure ControlEncryption PostureIdentity & ITDRSession AssuranceZTNA PostureThreat IntelligenceCustom DetectionsObservabilitySIEM ForwardingBrowser & IDE SecurityComplianceEndpoint EffectorsIR ShellAutonomic RemediationAnalyst Workflows
OffensivePenetration TestingRed TeamingAI Red TeamingAdversary SimulationVulnerability AssessmentsApplication Security AssessmentsDetectionManaged Detection & ResponseThreat HuntingIncident Response RetainersIncident Readiness & ResponseDetection EngineeringPreparednessTabletop ExercisesRansomware Readiness AssessmentsIncident Response Plan Development and TestingSecure Software Development AssessmentArchitectureSecurity Program DesignSecurity Maturity AssessmentsZero Trust AssessmentsCloud Security Architecture ReviewsRiskSupply Chain Risk ManagementSoftware Supply Chain SecurityQuantum Readiness AssessmentsData Security Assessments
Architecture LibraryWhitepapersPerspectivesAnalyst & Investor BriefingsGlossaryEvents
Company overviewVisionCode of EthicsLeadershipCareersNews & PressContact
Worldwide (EN) United Kingdom Australia Singapore India France Deutschland Brasil Latinoamérica 日本 대한민국
Sign inContact us
Human-led security service

Tabletop Exercises

Rehearse critical decisions, authority, dependencies, and communications before a real event.

Plan an exercise →
What we evaluate

Scope the decision before testing the control.

Rehearse critical decisions, authority, dependencies, and communications before a real event. Scope, access, evidence sources, and safety conditions are agreed before work begins.

01

Authorize

Confirm objectives, owners, scope, access, and stop conditions in writing.

02

Evaluate

Gather and test evidence using practices appropriate to the agreed environment.

03

Validate

Review observations, uncertainty, business context, and practical remediation priorities.

04

Brief

Deliver decision-ready findings, owners, dependencies, and recommended next actions.

What you receive

Evidence your team can act on.

Deliverable

Scenario and injects

Documented for decision-making, ownership, and follow-through.

Deliverable

participant decisions

Documented for decision-making, ownership, and follow-through.

Deliverable

observed gaps

Documented for decision-making, ownership, and follow-through.

Deliverable

after-action owners and target dates

Documented for decision-making, ownership, and follow-through.

Standards-informed approach

Recognized practices, applied to the engagement.

References guide the method and evidence boundary. They do not make this engagement an accredited audit, certification, legal opinion, or formal PCI validation.

Reference

NIST SP 800-84 and SP 800-61 Rev. 3

Used to structure applicable scope, evidence, and recommendations—not to assert certification or compliance.

Reference

NIST CSF 2.0 Respond and Recover

Used to structure applicable scope, evidence, and recommendations—not to assert certification or compliance.

Reference

ISO 22301 and ISO/IEC 27035

Used to structure applicable scope, evidence, and recommendations—not to assert certification or compliance.

Reference

PCI DSS 12.10.2 conditionally

Used to structure applicable scope, evidence, and recommendations—not to assert certification or compliance.

Customer-authorized by design

Start with the outcome and scope.

Our services are human-led, customer-authorized engagements. The Spacetime platform remains purely defensive.

Plan an exercise →