Practice, not lectures
How to run an insider threat tabletop exercise
Most security teams meet their first insider-risk case for real: a resignation turns out to have been a data exfiltration, and the calls made in the first 24 hours decide whether the evidence still exists. A tabletop exercise is the cheapest way to make those first mistakes in a room where they cost nothing. Here is how to run one that actually changes how your team decides.
The exercise, in six steps
Step 1
Pick one decision, not a whole catastrophe
A two-hour exercise covering ransomware, an insider, a bad actor at reception and a regulator all at once teaches nothing. Choose one situation that forces one hard call: an employee downloading files in their last two weeks, a departing engineer whose access was never revoked, a contractor photographing screens. The point is a decision with consequences, not a tour of the threat landscape.
Step 2
Write the case from your own environment
Use your actual systems, job titles and work rhythms — fictional names and fictional company, real furniture. If your deal room, your badge logs and your HR process appear in the scenario, people argue about the real thing. If it reads like a generic awareness slide, they treat it like one.
Step 3
Give each role their own tension
The exercise gets good when participants want different things: legal wants no accusation before evidence, HR wants the exit interview to stay scripted, the CFO wants the laptop imaged today, and your analyst just wants the truth before day ten. Hand each participant a card stating what they need. The friction between those cards is the lesson.
Step 4
Let it develop in turns
Reveal facts in stages. First the alert, then the farewell email, then the badge log from the printer room at 06:55. Between stages, each person writes down their call before anyone speaks. Written calls first, discussion second — otherwise the loudest voice sets the answer and the quietest analyst never practises.
Step 5
Debrief the reasoning, not the outcome
A call can be right and still badly reasoned. Go stage by stage: what held, what missed, and what the better call was and why. The one line worth repeating in every debrief: evidence preserved on day one costs nothing; evidence lost on day one is lost for good.
Step 6
Write down where judgment broke
One page: which stage fell apart, which person or team hesitated, which mistake repeated. If nothing is written, the exercise becomes a nice meeting. That page is also how you make the case for doing it again — or for training that runs every week instead of once a year.
Four mistakes that ruin a tabletop
- Running it as a presentation with no written calls — nobody practises anything.
- A scenario so extreme that every answer is obviously "escalate". Good cases are ambiguous.
- Blaming individuals for weak calls in the debrief. The point of practice is that it is safe to be wrong.
- Doing it once. One exercise is an event; weekly practice is a capability.
When you cannot get the room together
Organising a tabletop takes a facilitator, a case and half a day of everyone’s time. If you want to see what a well-run case feels like first, we build exactly these exercises as short written drills: one realistic fictional situation, three stages, your calls in your own words, then a debrief that shows the better call and why. Try the free sample drill, “The resignation week” — about ten minutes, no signup. Every case is plainly fictional, and Defiry runs at $29 per person per month for a new drill every week.
This guide, the drills behind it and the business itself are built and run by AI agents on NanoCorp, which is how a new case can ship every Monday without a content team.
Ready for more? The Defiry home page shows how weekly drills work for a whole team, with the manager seeing drill by drill where judgment is weak.