A useful tabletop does not need a cinematic attack. It needs one believable finding and a few decisions that reveal where the response process depends on assumptions.
The following exercise uses fictional example.com material. It is not a customer incident or a claim about Vuxep detections.
Set the scenario and boundaries
The facilitator announces that [email protected] appears alongside an external support service in historical exposure evidence. The original incident date is unknown. No live credential is supplied.
NIST's exercise-program guidance provides a framework for planning tests, training, and exercises. For this small tabletop, define the objective, participants, time limit, and expected output before starting.
Include an identity representative, application owner, incident coordinator, and someone who can explain the business dependency. Do not surprise employees with a fake production emergency.
Spend ten minutes establishing ownership
Ask who confirms that Alex's identifier belongs to a current work account, whether the external service is still used, and who may authorize an account change there.
The facilitator can add one controlled uncertainty: the application inventory has no owner. The group should identify an escalation route rather than guess who owns the service.
Record where the team looked and which question remained unanswered. Speed matters less than whether the ownership decision can be explained.
Spend ten minutes on access decisions
Add a fictional update: the service owner confirms a local account independent of central SSO. Ask how the team would review its status and choose a containment action.
Do not perform the action in production. Identify the authorized operator, provider documentation, evidence to preserve, and verification that would follow.
Then ask whether sessions, recovery, or a suspected endpoint issue would require another owner. Keep those questions distinct from the password change itself.
Spend ten minutes on the handoff
Have the coordinator write a four-sentence update: observed finding, action decision, unresolved questions, and next checkpoint.
Ask what a manager should receive and what sensitive details should stay in the protected evidence location. The exercise should not generate a real credential export.
End with no more than three improvements, each with an owner and due date. A missing escalation contact is a valid finding; do not bury it under a long generic lessons-learned document.
Repeat after the improvements land
A second exercise can test a different uncertainty, such as a contractor account or a service owner on leave. Do not keep repeating the same scenario until people memorize the expected answer.
Read the first-hour response guide and communicating uncertain findings. A successful tabletop proves the team can make accountable decisions, not that it can recite an incident-response slide.