Article

Why cyber tabletop exercises matter more than ever

Despite ongoing claims activity, the cost of cyber insurance has fallen from its recent peak. Discover why now is a good time to review your cover.

Cyber risk is no longer just a technical issue for infosec and IT teams. Today, a cyber incident quickly becomes a legal, operational, reputational, financial, and client-retention crisis. This is why cyber security is now a business-wide responsibility, supported by effective risk management.

That was the central message from our recent Cyber Tabletop Exercise event, which brought together crisis management, legal, and cyber specialists to explore how a realistic attack can escalate across an organisation. From encrypted systems, data exfiltration, ransom demands, media scrutiny, regulatory pressure, and client concern – cyber events have become complex and can rapidly affect the whole business.

The exercise considered a hypothetical cyber incident involving a real attack scenario, helping participants understand the potential regulatory consequences and wider business impact.

The three practical priorities for organisations include:

Know your cyber policy and the specialist vendors it gives you access to when an incident hits.
Invest in resilient IT to strengthen continuity, containment, and recovery.
Put your response to the test with annual tabletop exercises that builds confidence before a live incident.

Taken together, these actions help organisations strengthen incident readiness, close gaps in their incident response capabilities and make faster, more confident decisions when a cyber event occurs. They also help organisations identify areas for improvement, incorporate lessons learned and prepare for the decisions that may be required during a live event.

Cyber incidents now unfold across the whole business

Cyber incidents rarely stay contained within a single function. A technical problem can very quickly trigger wider business impacts across different teams and key stakeholders:

disruption to core operations, particularly where key systems, data, or suppliers are affected;
rapid legal, regulatory, and contractual notification requirements across multiple jurisdictions;
heightened concern from employees, customers, and stakeholders about data security, business continuity and recovery timelines;
intense scrutiny from regulators, investors, and the media;
high-pressure decisions for leadership on communications, customer impact, extortion demands, containment and recovery prioritisation;
and, in more severe cases, lasting damage to trust, reputation, and revenue.

These impacts may involve various cyber threat vectors, including phishing, ransomware, supply chain compromise and insider threats.

The scenario we used showed how an initial system outage escalated into a suspected ransomware attack with data theft, operational shutdown, and public scrutiny. As the incident developed, the response team had to balance technical investigations with questions about insurer notification, legal privilege, internal and external communications, and whether to engage with the threat actor.

The scenario also highlighted how an attack affecting industrial control systems or other critical technology could create further operational and safety concerns. Organisations may need to understand how an incident affects both digital platforms and actual systems.

That is the reality of modern cyber crisis management: the technical response is only one part of the challenge. An effective cyber incident response must bring together technical, legal, operational and communications expertise.

AI is changing the threat landscape

Artificial intelligence is now shaping both sides of the cyber equation.

On the attacker side, AI is helping threat actors improve social engineering, scale phishing, and potentially accelerate the discovery of technical weaknesses. The exercise scenario explored a highly targeted intrusion in which investigators suspected AI had been used to identify a vulnerability and speed up exploit development.

For cybersecurity teams, this means assessing how AI may influence cyber threat vectors and the organisation’s wider cybersecurity posture.

For organisations, this means the threat landscape is becoming faster, more tailored, and unpredictable. It also means that traditional assumptions about what cyber risk looks like may no longer be enough. Preparedness now needs to account for a broader set of attack paths, more complex incident patterns, and greater pressure on response teams once an event occurs.

The most serious incidents are multi-vector incidents

Cyber claims and incidents are becoming more complex, not less. A single event can now trigger several overlapping exposures at the same time, including:

privacy and data breach exposure;
extortion demands;
business interruption losses;
third-party or supply chain failure;
and litigation risk.

These overlapping exposures can create several regulatory requirements and make it harder for decision makers to understand which key decisions need to be made first.

This matters because incidents with multiple impact areas are harder to assess, manage, and resolve. They typically require faster coordination across internal teams, external advisors, and insurers, often while key facts are still emerging. As such. organisations need clarity in advance on who leads the response, who approves key actions, how information is escalated, and when legal, forensic, communications, and other specialist support should be engaged. In a live incident, uncertainty in those early decisions can increase disruption, prolong recovery, and materially raise the overall cost of the event.

Specialist vendor support is paramount

These panel firms typically bring expertise across digital forensics, ransomware negotiation, breach counsel, and crisis communications, becoming a critical extension of your internal response team during a live event. Their experience helps organisations navigate fast-moving technical, legal, regulatory, and reputational challenges with confidence, drawing on current threat intelligence and proven response practices. Establishing confidence in your chosen panel ahead of time is essential: when an incident happens, teams need trusted advisors who can engage immediately, work seamlessly together, and support decisive action.

Resilient IT systems are the backbone of recovery

Strong, resilient technology is not just an IT investment, it is a core business continuity capability. In a cyber incident, the ability to isolate affected systems, restore critical services, access clean and tested backups, and operate through alternative working arrangements can have a direct impact on the effectiveness of recovery.

Organisations should maintain clear recovery plans that reflect their critical services, suppliers and technology dependencies.

Recovery is rarely straightforward. When systems are encrypted, core platforms are unavailable, and manual workarounds only go so far, organisations can remain operationally constrained for longer than expected. There is also a significant risk in restoring too early, before the root cause has been understood, compromised access has been contained, and the environment has been properly validated.

Preparedness therefore goes beyond prevention alone. It depends on designing for recovery, testing that recovery under realistic conditions, and giving leadership the information they need to make sound decisions under pressure.

Tabletop exercises build leadership confidence before a crisis hits

Tabletop exercises are one of the most effective ways for organisations to stress test their incident response plans and decision-making before facing a live event. These discussion-based exercises can be used to conduct realistic cyber drills without disrupting live operations

They give leadership teams the opportunity to validate roles and responsibilities, expose gaps in escalation pathways, test communications strategies, and understand how legal, HR, IT, risk, and communications functions must work together under pressure. The discussion allows participants to explore how they would respond, what procedures they would follow and which resources they would need.

Just as importantly, they allow teams to rehearse decision making when information is incomplete and timelines are compressed. This is where real confidence is built. A well-designed exercise not only reveals weaknesses in plans and processes before a real incident does, but also creates practical actions that strengthen readiness, improve coordination, and enable faster, more assured decisions when it matters most.

The main benefits include clearer responsibilities, stronger coordination and practical improvements to response planning.

A broader lesson: cyber resilience is a board-level issue

Cyber resilience is now a governance issue, not just a technology issue. Boards and senior leaders need confidence that their organisation can respond quickly, communicate clearly, and recover effectively if the worst happens.

That means asking difficult questions now:

Do we know our critical suppliers and their vulnerabilities?
Could we operate if core systems were unavailable for days?
Do we know when to notify insurers, clients/customers, and regulators?
Are our response plans tested and current?
Would our leadership team know what to do in the first hour?

These questions can help boards understand how well their organisation is positioned to manage cyber-attack risk and whether further improvements are needed.

Organisations that can answer those questions with confidence are far better positioned to manage a cyber crisis.

The bottom line

Cyber incidents are becoming more sophisticated and disruptive. AI is accelerating the threat landscape, third-party risk is widening the attack surface, and recovery is becoming more dependent on planning, coordination, and tested resilience.

Organisations that build trusted relationships with their response specialists, invest in resilient systems, and test their response through realistic exercises will be better equipped to protect their operations, commercial position, and trust when a cyber incident strikes.

Regular exercises can help organisations prepare, evaluate and refine their response before a crisis occurs, while improving awareness among those involved.

In Technology Research Facility: Female Project Manager Talks With Chief Engineer, they Consult Tablet Computer. Team of Industrial Engineers, Developers Work on Engine Design Using Computers

Video

Why cyber tabletop exercises matter more than ever

Cyber incidents now unfold across the whole business

AI is changing the threat landscape

The most serious incidents are multi-vector incidents

Specialist vendor support is paramount

Resilient IT systems are the backbone of recovery

Tabletop exercises build leadership confidence before a crisis hits

A broader lesson: cyber resilience is a board-level issue

The bottom line

Related insights

Why Cyber Matters for Manufacturers

Risk in Context Podcast: Rethinking cybersecurity controls for an AI-driven world

Marsh Retail Leaders Report 2026

Beyond efficiency: AI’s next frontier in employee benefits

Why cyber tabletop exercises matter more than ever

Cyber incidents now unfold across the whole business

AI is changing the threat landscape

The most serious incidents are multi-vector incidents

Specialist vendor support is paramount

Resilient IT systems are the backbone of recovery

Tabletop exercises build leadership confidence before a crisis hits

A broader lesson: cyber resilience is a board-level issue

The bottom line

Cyber tabletop services

Related insights

Why Cyber Matters for Manufacturers

Risk in Context Podcast: Rethinking cybersecurity controls for an AI-driven world

Marsh Retail Leaders Report 2026

Beyond efficiency: AI’s next frontier in employee benefits