The fastest way to learn that your incident playbooks were written for a world that no longer exists is to run them against a world that does.
The Tabletop is a structured, facilitated exercise running three scenarios drawn from real recent incidents — voice-cloned executive fraud, deepfake video impersonation in live meetings, and AI-augmented spear phishing that bypasses every awareness control most organisations rely on.
The audience is not the security team. It is the people who actually answer the phone, authorise the payment, and approve the wire — finance, treasury, the executive office, and the board. They are the targets these attacks are designed for. They are the ones who need to rehearse.
Output is not a slide deck. It is a gap report and three to five concrete playbook changes the organisation can implement within thirty days — backed by a debrief session that ensures the lessons stick.
A finance team member receives a phone call, in their CFO's voice, asking them to authorise an urgent wire transfer to close out an acquisition. The voice is correct. The urgency is plausible. The supporting email arrives moments later. Where in your current process does this stop? The scenario plays through call, email, and SMS escalation — and the room discovers exactly which controls survive contact with a £5 million voice-cloned request.
A senior leader joins a Teams call with what appears to be the CEO and the head of M&A, on camera, discussing a confidential transaction. Within twenty minutes the leader is asked to share a sensitive document and approve a credential reset. The faces are right. The voices are right. The references to last week's offsite check out. The call is entirely synthetic. The exercise walks the room through every signal that would have caught it — and every one that would not.
A wave of personalised emails arrives across the leadership team. Each one is bespoke — referencing real projects, real meeting outcomes, real stylistic quirks of the apparent sender. The links are clean. The grammar is perfect. The context is uncannily accurate. This is what happens when an attacker scrapes LinkedIn, runs the data through an LLM, and ships ten thousand near-perfect spears in a single afternoon. The exercise rehearses detection, response, and the conversation that has to happen with every recipient.
A 60-minute context interview with the security and finance leaders. Scenarios are tailored to your real org chart, your real approval workflows, and your real adversary profile.
Half-day facilitated exercise. Three scenarios run sequentially with pause-and-discuss decision points. Observers from security take notes; participants make the calls.
A 60-minute structured debrief one week later. Reflections from participants. Targeted recommendations from facilitators. Honest discussion of what almost worked — and what almost didn't.
Written gap report with three to five concrete playbook changes ready for implementation within thirty days. Designed to fit into existing incident response and finance approval workflows.
Your finance team approves wire transfers, processes reimbursements, and authorises vendor changes every day. AI-augmented fraud is now a credible and frequent threat against exactly this workflow. The tabletop is the cheapest way to find the holes before the attacker does.
The committee is hearing assurances from management that AI-era fraud risk is "covered." An independent tabletop with the same management team in the room generates the kind of evidence the committee can rely on rather than minute.
You know the SOC is ready. You are less sure that finance, the executive office, and the comms team are. The tabletop is structured to expose those gaps and create cross-functional muscle memory in a single contained session.
The fastest way to know whether the Tabletop is the right next step is to talk. No pitch, no proposal until both sides agree the engagement is right.