Running an Executive Crisis Tabletop

Reading time ~11 minutes · No technical prerequisites · Day 3, Capstone

The capstone is a facilitated tabletop: a structured, low-cost rehearsal of a crisis in which participants make real decisions against a ticking clock, without touching live systems. Its purpose is not to test technical knowledge but to exercise judgment under pressure and to reveal, safely, the gaps between the plans an organisation believes it has and the decisions it can actually make when the clock is running.

Why rehearsal is a control

Every earlier lesson argued that the decisive moves in a crisis are made beforehand — resilience funded, policies pre-decided, verification rules and communication plans agreed. A tabletop is where those claims are tested. Teams discover whether their crisis roster is more than a list, whether their backups have really been restored, whether anyone has a pre-agreed challenge phrase, and whether they can reach a travelling principal when the primary channel fails. The discomfort of finding a gap in an exercise is precisely its value; the alternative is finding it during the real event.

The roles

A tabletop needs three roles. The facilitator reveals each inject, starts the clock, and keeps the pressure honest by refusing to let the team "wait and see" past the timer. The participants act as the leadership team and decide out loud, so their reasoning is visible. The scribe records not only what was decided but why, because the reasoning is what the after-action review examines. Keeping these roles distinct is what makes the exercise more than a discussion.

How this capstone ties the course together

The Aegis Group scenario escalates deliberately across every front the course has covered. A deepfake payment request tests the verification rule of Lesson 9. An account compromise with an insider signal tests the evidence-versus-inference discipline of Lesson 13 and the proportionate insider handling of Lesson 6. A ransomware detonation with data theft tests whether pay/no-pay was pre-decided and whether backups are real, from Lesson 12. A kinetic complication abroad — a travelling principal's device out of sight in a higher-risk jurisdiction — tests the travel and mobile discipline of Lessons 7 and 8 and the PACE communication plan of Lesson 9. And a media inquiry under contested attribution tests the calibrated-uncertainty communication of Lessons 2 and 13. No single vector is technical; each forces a leadership decision under time.

You cannot out-think a crisis in the moment. You can only arrive with the decisions, plans, and rehearsals already in place.

The hotwash

The exercise is completed by a structured after-action review, or hotwash: what went well, what hurt, what surprised the team, and — the real deliverable — what changes on Monday, expressed as a few concrete actions with named owners. The review must be blame-free, applying the same culture principle from Lessons 4 and 6 to the team examining its own performance. A tabletop that ends without owned actions was entertainment; one that produces them is a control that measurably reduces the cost of the next real incident.