Also known as: TTX · incident simulation
A tabletop exercise is a discussion-based simulation in which a team walks through their response to a hypothetical security incident, testing decision-making and procedures without touching production systems.
The value lies less in testing technical capability than in surfacing organisational gaps: who has authority to take a revenue-generating system offline, how legal and communications are engaged, whether anyone knows the out-of-band contact details for key staff if email is compromised.
Effective exercises inject complications mid-scenario — the on-call engineer is unreachable, the backups are also encrypted, a journalist calls — because the failure modes worth finding are the ones that only appear when the clean plan stops working.
Incident Response
Incident response is the structured process an organisation follows to detect, contain, eradicate, and recover from a security incident, and to learn from it afterwards.
Ransomware
Ransomware is malicious software that denies an organisation access to its own data — historically by encrypting it — and demands payment in exchange for restoring access or withholding publication of stolen data.
Dwell Time
Dwell time is the length of time an attacker remains undetected inside a compromised environment, measured from initial intrusion to detection.
Backup and Recovery
Backup and recovery is the practice of maintaining recoverable copies of data and systems, and verifying that restoration actually works, so that an organisation can recover from destruction, corruption, or ransomware.