What the tabletop platform includes
Cyber-shaped scenario library
Ransomware, BEC, insider, supply chain, cloud compromise, third-party SaaS, PCI, HIPAA, SEC 1.05, APT, DDoS+extortion, AI-impersonation. Expanding monthly.
Role-specific injects
Each IRC role receives scenario injects scoped to their lens: technical for the IC and Tech Lead, legal for the GC, comms for the Comms Lead, financial for the CFO.
Live regulatory clocks
GDPR, HIPAA, SEC, NY DFS, NIS2, DORA, state laws, carrier first-notice. Run live during the tabletop in compressed time. The team practices hitting them.
Watermarked SAMPLE artifacts
Holding statements, breach notifications, 8-K drafts, AAR. Every export carries a non-removable SAMPLE watermark and tabletop disclaimer footer.
8-section AAR
Auto-generated: summary, timeline, what worked, gaps with severity, SLA compliance, regulatory status, recommendations, next-tabletop scope. Gaps flow into the remediation tracker.
Founder-led managed option
Theater tier includes facilitated tabletops led by Mark Lynd. 150+ real C-Suite tabletops worth of pattern recognition applied to the team's specific environment.
Tabletops as readiness proof
Tabletops are not just practice. They are the artifact regulators, insurers, and the audit committee ask for as proof of readiness. NY DFS Part 500.16 requires annual tabletops. NIS2 and DORA require periodic testing of incident handling. Most cyber insurance policies require annual tabletops as a binder condition; some require quarterly. The IR-OS tabletop record - hash-chained, signed at completion, exportable - is the artifact that satisfies those requirements without separate paperwork. The same record that proves the team can respond also satisfies the regulator and the carrier.
Common questions
What scenarios does the IR-OS tabletop library include?
Twelve cyber-shaped scenarios at launch, expanding monthly. Ransomware (encryption-only and exfiltration variants), business email compromise, insider threat, supply-chain compromise, cloud account takeover, third-party SaaS breach, payment-card compromise (PCI), healthcare data breach (HIPAA), public-company material incident (SEC 1.05), nation-state APT, DDoS plus extortion, and AI-generated impersonation. Each scenario includes injects, role-specific prompts, and an expected-decisions reference for the facilitator.
Why do tabletops on the same platform as live response?
Because muscle memory matters. If the team only sees the command surface during a real incident, they spend the first hour learning the platform instead of running the response. Tabletops on the live platform - in tabletop mode with watermarked SAMPLE artifacts - mean the team is already fluent on Day 1 of a real incident. The same IR plan, IRC roles, runbooks, and clocks are exercised.
What does the 8-section AAR cover?
Executive summary, timeline, what worked, gaps identified with severity, SLA compliance, regulatory status, recommendations, and next-tabletop scope. Auto-generated from the tabletop record. Gaps flow into the gap analysis tracker for remediation. The next tabletop is scheduled with the surfaced gaps as priority focus.
Does the tabletop produce a defensible record?
Tabletop records are written to the same hash-chained ledger as live incidents, marked as exercise. Drafts and exports carry a SAMPLE watermark that cannot be removed. The exercise record demonstrates readiness to regulators (NY DFS Part 500.16, NIS2, DORA periodic-testing requirements), insurers (most cyber policies require annual tabletops), and the audit committee.
Who facilitates the tabletop?
The platform supports both self-facilitated tabletops (the security team or GRC lead runs it) and externally facilitated. The expected-decisions reference is hidden from participants until the after-discussion phase. For organizations that want a senior facilitator, IR-OS offers a managed tabletop service on Theater tier facilitated by founder Mark Lynd, who has run 150+ C-Suite tabletops.