Plan and contact review
We read your response plan and contacts first, so the exercise tests the plan you actually have.
The Problem
A Response Plan Nobody Has Practiced Breaks at the First Decision
It shows up in the first real incident, when people open the plan for the first time and find names, numbers, and decisions that no longer fit.
01 · Contacts
The plan names people who have already left the company.
We check every name and number against your current team before the session.
02 · Decision rights
Nobody is sure who may take systems offline.
An early inject forces that decision, and the log records who made it.
03 · Plan access
The plan lives on the server that just got encrypted.
The scenario tests whether your team can reach the plan with systems down.
04 · Follow-through
Lessons from past drills were noted, then forgotten.
Each finding gets an owner and a due date in the improvement plan.
Your incident response plan was approved last spring and hasn't been opened since. At 7:40 a.m. on a payroll Monday, the finance lead can't log in, and the file server shows a ransom note. The plan says the incident lead decides on isolation, but that person left in June. The insurer's hotline is written in the plan, which sits on the encrypted server. Nobody has practiced any of this, so the first hour goes on guessing.
We start with your own plan and systems, not a generic scenario. We build one realistic incident around your tools, then release it in timed rounds of injects while your team responds from the plan. An observer records every decision and when it was made. The hotwash captures what everyone noticed, and the report turns it into fixes with owners and dates. Your team finds the gaps in a practice session, not in the middle of an attack.
Timed rounds of injects
New facts arrive every few minutes, so your team decides under the pressure of a real incident.
Decisions logged as they happen
An observer records each decision, who made it, and how long it took to make.
Fixes with owners and dates
Your after-action report ends in an improvement plan, not a loose list of observations.
Our Cybersecurity Tabletop Exercise Process
From Scenario Call to an Improvement Plan in Five Clear Steps
You approve the scenario and injects before the session, take part in the exercise, and review the report and fixes with your leads.
We talk through your response plan, your team, and the incidents that worry you most. You get a written scope, a list of people to invite, and a fixed price. If CISA's public exercise packages fit your team as they are, we'll tell you before we quote.
What's Included
What You Get With a Cyber Incident Tabletop Exercise
Each exercise covers a plan review, a scenario on your systems, four inject rounds, facilitation, a decision log, a hotwash, and an after-action report with fixes.
Compare Options
DeveloperLook vs a Self-Run Kit vs a Large Consultancy
A self-run kit such as CISA's public exercise packages needs only your own facilitator, and a large consultancy brings a big team and a known name. Here is how a facilitated exercise on your own plan compares.
| Feature | DeveloperLookBest fit | Self-run kit | Large consultancy |
|---|---|---|---|
| Planning | Built from your plan and systems | Generic scenario you adapt | Discovery workshops |
| Scenario | Your tools, vendors, and data | Sector-level scenario | Custom, often multi-day |
| Facilitation | Neutral outside facilitator | Someone from your own team | Senior facilitators |
| Injects | 4 timed rounds | Printed discussion questions | Timed, sometimes with role-play |
| Evidence | Decision log with timestamps | Notes if someone takes them | Detailed evaluation |
| Report | Improvement plan in 10 days | Up to you | Formal report, longer wait |
| Your team's time | One 2 to 3 hour session | Prep, run, and write-up | Several workshops |
| Cost | Fixed price from $1,050 | No license cost | Large fixed fee |
DeveloperLook
Self-run kit
- Planning
- DeveloperLook: Built from your plan and systemsSelf-run kit: Generic scenario you adapt
- Scenario
- DeveloperLook: Your tools, vendors, and dataSelf-run kit: Sector-level scenario
- Facilitation
- DeveloperLook: Neutral outside facilitatorSelf-run kit: Someone from your own team
- Injects
- DeveloperLook: 4 timed roundsSelf-run kit: Printed discussion questions
- Evidence
- DeveloperLook: Decision log with timestampsSelf-run kit: Notes if someone takes them
- Report
- DeveloperLook: Improvement plan in 10 daysSelf-run kit: Up to you
- Your team's time
- DeveloperLook: One 2 to 3 hour sessionSelf-run kit: Prep, run, and write-up
- Cost
- DeveloperLook: Fixed price from $1,050Self-run kit: No license cost
Projects We've Built
Health, Delivery, Crypto, and Travel Apps We Have Built
Apps we built for teams whose customers notice within minutes when systems go down. Teams like these rehearse their response before an incident forces it.
TruDoc Medical Appointment App Design & Development
- Medical
- Booking System
- Dashboard
Foodies Restaurant Food Delivery App Design & Development
- Food & Beverage
- Food Delivery
- Dashboard
CoinSphere Crypto App Design & Development
- Crypto & NFT
- Dashboard
- Mobile App
Toursin Travel and Tour App with Agency Dashboard
- Travel
- Vacation Rental
- Booking System
What Our Clients Say
What Clients Say After Launch
Feedback from teams we have built apps, platforms, and websites for.
We had a pretty specific idea of what we wanted our website to become, but I wasn’t sure how easily we could explain all of it to a development team. There were quite a few moving parts, and we were working toward a deadline, so I expected a few things to get lost along the way. That never really happened. They understood what we were trying to achieve, kept us updated throughout the process, and got everything ready within the agreed timeline. The final site feels much easier to navigate, works beautifully on mobile, and is noticeably smoother for our customers. It was a huge relief seeing the original idea actually turn into the website we had in mind.
The mobile experience is probably my favourite part of the new site. We had spent a lot of time making sure the desktop version looked right, and the team kept pushing us to think about how everything would actually feel on a phone too. They were right. The navigation is clean, the interactions feel natural, and everything we’ve tested so far works exactly as it should. They also went through the links, forms, integrations, and other details more than once before launch, which I really appreciated. And even after going live, we could still reach out when something came up. The whole process felt friendly, organised, and surprisingly straightforward.
What I appreciate most is that the website is actually easy for us to manage now. We can update content ourselves instead of sending a developer a message every time we need to change something small. They also paid attention to the technical SEO side, which mattered to us because we didn’t want a new website to create problems for the traffic we already had. I’ve probably asked more questions than I should have since launch, but every question has been handled patiently and without any fuss. The team is easy to work with, they explain things clearly, and when we need something changed, they focus on getting it done rather than making the process complicated.
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
Want results like these?
Tell us what you are building. You get a reply within 24 hours on business days, then a written estimate.
Work Culture
Why Security Leads Trust Us With Their Tabletop Exercises
An exercise only helps if people speak honestly and the findings get fixed. These habits keep your session realistic, blame-free, and useful long after the call ends.
No blame in the room
We test the plan, not the people. When nobody fears looking bad, your team says what they'd really do, and that's what the report needs.
Your systems, not movie plots
Scenarios use your real tools, vendors, and data. Your team argues about decisions it could face next month, not an imaginary attack.
Injects stay secret
Only your sponsor sees the injects before the session. Participants react as they would in a real incident, so the gaps you find are real too.
Short, focused sessions
A tabletop runs 2 to 3 hours, not a full day. Busy executives stay engaged, and you can repeat the exercise every year.
One fixed price
You get a fixed price once the scenario and participants are agreed. A second session or scenario is quoted before we write it.
Scenario files you keep
You keep the scenario, injects, and report in editable files. Your team can rerun the exercise later with new people, without us.
Overview
How does a cybersecurity tabletop exercise work?
DeveloperLook runs a cybersecurity tabletop exercise built on your own response plan and systems. We review the plan, write one realistic scenario, and release four timed rounds of injects while an observer logs decisions. A hotwash and an improvement plan follow. Exercises start at $1,050 and take 2 to 3 weeks, with the report 10 business days later.
DEVELOPERLOOK
Project facts · Cybersecurity Tabletop Exercise
- Service
- Cybersecurity tabletop exercise (scenario, timed injects, facilitation, after-action report)
- Typical timeline
- 2 to 3 weeks to the exercise, report within 10 business days
- Platforms
- Zoom, Microsoft Teams, Google Meet, or Webex sessions
- Built with
- Scenario and inject files, Miro boards, shared decision logs
- Experience
- 10+ years of development experience and 1,250+ shipped projects
- Post-launch support
- 30 days of support after the report
- Communication
- Calls in US, UK, and AU business hours
- Starting price
- From $1,050 USD, fixed scope after a free scenario call
Reviewed 23 Oct 2026 by Saimul Islam
Good fit
Companies with an untested response plan
Your incident response plan was signed off last year, and nobody has walked through it since. You want to find its gaps before an attacker does.
Payment teams facing PCI DSS assessments
Your PCI DSS assessor wants proof that the response plan was tested in the last 12 months, and you'd rather show a real exercise than a memo.
Leadership teams new to cyber incidents
Your executives have never made a ransomware decision together, and you want them to rehearse a security tabletop exercise before the real call comes.
Financial firms regulated by NYDFS
Your firm must test its incident response and recovery plans at least annually under NYDFS Part 500, with the staff and managers critical to the response.
MSPs running client security programs
Your clients' insurers keep asking about plan testing, and you want to offer a cyber incident tabletop exercise under your own brand.
Not a fit
No written plan yet
You don't have an incident response plan to test yet. Our incident response plan development writes it first, and a tabletop exercise can follow once it's signed off.
Need a restore test
You want proof that backups restore and systems come back in the right order. Our disaster recovery planning services include a witnessed restore test.
Want a live attack test
You want someone to attack your systems for real, not discuss a scenario. Our web application penetration testing services test your apps hands-on.
Budget under $1,050
Your budget is under $1,050 and your team is small. CISA's public tabletop exercise packages, run by someone on your own team, are a fair first step.
Not sure we're the right fit?
Book a free call or message us. We'll tell you honestly whether we're the right team.
Pricing
Transparent Starting Prices for a Cybersecurity Tabletop Exercise
These are starting points in USD. Your final price depends on the sessions, the people taking part, and the scenarios you need, and you get a fixed proposal after a free scenario call.
For teams that need one realistic test of their response plan this year.
$1,050one-time, USD
- Review of your plan and contacts
- One scenario built on your systems
- 4 timed inject rounds in a 2 to 3 hour session
- Up to 12 participants by video
- Hotwash and after-action report in 10 days
- 30 days of support after the report
Recommended
For companies that need leadership and IT tested together on the same incident.
$2,400one-time, USD
- Everything in Leadership Tabletop
- Separate leadership and technical sessions
- Up to 25 participants
- Technical injects for your cloud and admin tools
- Suggested edits marked up in your plan
- Follow-up call after 60 days
For regulated teams that must show tested plans to auditors, insurers, or boards.
$4,600one-time, USD
- Everything in Two-Track Exercise
- 3 exercises over 12 months
- One scenario with a key vendor or supplier
- Board or leadership briefing
- Improvement tracker across all exercises
- Evidence pack for PCI DSS or NYDFS reviews
For Agencies
White-Label Cyber Tabletop Exercise Facilitation for MSPs
You own the client relationship. We build the scenario from your client's plan and systems, facilitate under your brand, and write the report in your template. Your clients get a tested plan, and you add a service without hiring a facilitator.
How the partnership works
White label: your client only ever sees your brand
- Your client
- You, the agency
- DeveloperLook
Share the client's plan
Send the client's response plan, team list, and the incidents they worry about most.
- Client needs
- You share the details
- Details received
We design the scenario
You review the scenario and injects before the client's team sees anything.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Facilitate and report
We run the session under your brand and deliver the report in your template.
- Done by our team
- Your brand on it
- Handed to your clientDone
Partner with DeveloperLookDelivered under your brand
Run under your brand
We facilitate as part of your team, with your name on everything.
Scenario library
Proven scenarios adapted to each client's own tools and vendors.
Repeatable yearly service
An annual exercise your clients can renew, with their past fixes tracked.
Fixed price per client
Each exercise is priced up front, so your margin stays clear.
The Right Technology for Your Project
Technology Stack
Sessions run on the video tool your team already uses, injects arrive on screen or in chat, and fixes land in the tracker you already work in.
- Zoom
- Microsoft Teams
- Google Meet
- Webex
- Miro
- Google Slides
- Microsoft PowerPoint
Slack
Google Sheets- Microsoft Excel
- Notion
- Confluence
- Jira
- Asana
- Trello
- ClickUp
FAQ
Frequently Asked Questions
Straight answers on cost, how an exercise works, who takes part, and whether it counts as testing your plan.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
A single leadership exercise from DeveloperLook starts at $1,050, with a plan review, one scenario, 4 timed inject rounds, facilitation, and an after-action report. Separate leadership and technical sessions cost $2,400. An annual program with 3 exercises, a vendor scenario, and an evidence pack starts at $4,600. You get a fixed price after the free scenario call.
Most exercises take 2 to 3 weeks from the scoping call. That covers about a week to review your plan, a week or two to build your scenario, and a 2 to 3 hour session. The after-action report follows within 10 business days. The annual program spreads 3 exercises across 12 months, so each one tests the last round of fixes.
It's a guided discussion where your team works through a realistic cyber incident, round by round, using your own response plan. Nobody touches live systems. A facilitator releases new facts, called injects, and asks what each of your people would do next. NIST SP 800-84 describes tabletop exercises as discussion-based, which keeps them low-cost and safe to run.
In cyber security, a tabletop exercise is the step between writing a response plan and trusting it. It tests decisions, communication, and roles rather than tools. NIST Cybersecurity Framework 2.0 expects improvements to come from security tests and exercises, including ones run with suppliers. It's a tabletop exercise cybersecurity leads can repeat every year as people and systems change.
Tabletop exercises are discussion-based rehearsals of an emergency, used for fires, floods, and outages as well as cyber attacks. FEMA's HSEEP doctrine lists them beside seminars, workshops, and games, and ends each one with a hotwash and an after-action report. Whether you call it a cyber table top exercise or a tabletop, the format is the same: a scenario, injects, and honest discussion.
The primary objective is to find the gaps in your response plan before a real incident does. That means unclear decision rights, missing contacts, untested assumptions about backups or insurers, and steps nobody owns. A good exercise ends with an improvement plan that gives each gap a person and a date, so your next incident goes better.
The people who would make or carry out decisions in a real incident take part. For most teams like yours, that means the incident lead, IT or your managed provider, a leadership sponsor, finance, HR, legal counsel, and communications. Some teams invite their cyber insurer's breach coach or a key vendor. We keep each session to about 12 people so everyone speaks.
Often, yes, but your assessor or regulator decides what counts as a test. PCI DSS requires testing the incident response plan at least once every 12 months. NYDFS Part 500 requires annual testing with the staff and management critical to the response. We document the scenario, attendees, and decisions, so you can show exactly what was tested and when.
We run every session by video, on Zoom, Microsoft Teams, Google Meet, or Webex. Your team can join from one meeting room or from home, which also tests whether people can coordinate when the office is out of reach. Injects appear on a shared screen or in chat, and the observer logs decisions in a shared sheet.
You get the after-action report within 10 business days, then 30 days of support to answer questions and help you update the plan. You keep the scenario, injects, and decision log in editable files, so your team can rerun the exercise. The Two-Track plan adds a follow-up call after 60 days to check progress on fixes.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Free 30-min callGoogle Meet
Book a call
Book a free 30-minute call
In 30 minutes on Google Meet we walk you through how we would build it, how long it takes and what it costs. Then you get a written estimate.
Calendar not showing? Book on cal.com or send a brief.