AXIS Global Cyber & Technology

Cybersecurity leader David Shluger, Head of Cyber Risk Advisory at AXIS, blends underwriting and risk engineering expertise to help global clients elevate cyber resilience, manage complex risk, and turn volatile threats into strategic, insurable outcomes.

In an exclusive interview with Cyber Security Review, he shared invaluable insights on how to close the gap between calm tabletop drills and chaotic real-world breaches through agile, realistic, and continuous practice.

Agile Tabletop Wins

When it comes to preparing for, protecting against, and responding to a cyber-incident, the balance between agility and preparedness can be hard to strike. And it evolves - cyber incident response planning that worked two years ago may not be effective in today’s cyber landscape.

A key element of cyber security is having a clear cyber incident response plan that will work effectively when the inevitable happens. Testing this is hard without a real cyber event and so introducing cybersecurity tabletop exercises can be invaluable in strengthening an organization’s cyber preparedness planning and ultimately post-event recovery.

Most prudent organizations put some level of effort into developing a cyber-incident response plan, and many make an attempt to test (or exercise) that plan. This typically comes in the form of a Cyber Tabletop Exercise, a semi-realistic scenariobased activity that requires the organization’s response team(s) to articulate how they would react. The effectiveness of this work can vary widely from one organization to the next, and in the aftermath of a true cyber incident, many wonder why they fared differently than they’d planned.

The effectiveness of cyber tabletop exercises can depend on the team’s preparation, the skillfulness of the facilitator, and the rigor to follow through on lessons learned. But even with effort and strong execution, an actual cyber incident is almost certainly going to turn out differently than it did in the tabletop version. Why?

Having seen thousands of cyber incidents from the perspective of insurance claims, a few truths seem to emerge:

- Cyber incidents can be highly emotional – even seasoned executives who have “seen it all” can resort to irrational decision-making when the IT infrastructure is paralyzed and business shuttered.

- Communication can become disorganized – without clear leadership and with traditional channels like email, messaging, and video conferencing potentially down, prudent timely decisions are harder to reach

- The Incident Response Plan is often detached from the reality of how threat actors operate and the insurance policy (if applicable) is designed

Knowing these realities can help teams practice more effectively in cyber incidents.

Unleash Cyber Resilience

Tabletop exercises are powerful tools however not all tabletop exercises are equal: one that is poorly executed is delivered at the wrong time, done merely to satisfy regulators or the board, or that is treated as a checkbox exercise within the organization, can cause more harm than good. When executive buy-in is lacking, or the outcomes of the exercise are easily predicted, this risk increases.

“When cyber risk turns from tabletop exercise to realworld crisis, preparedness is the calm that steadies emotion, focuses communication, and turns chaos into controlled recovery”

Depending on the experience and risk posture of the organization, it may be better served with targeted training, technical testing (e.g. – purple team exercise), or objective assessment against a defined framework (e.g. – NIST Cybersecurity Framework). An organization will get the most out of these exercises if it is already investing time, effort and resources into its cybersecurity program, and most importantly, has a clear objective in mind.

Well executed tabletop exercises are extremely effective in testing and elevating response planning within an overall risk management strategy. When your organization decides a tabletop exercise is the right tool, consider this best practice guidance:

- Build accessible, nimble playbooks that prioritize clear decisionmaking roles and responsibilities, authority levels, and protocols, rather than overly engineered prescriptive plans

- Have a clear objective for the exercise – don’t just “see where it takes you”

- Be clear on the format and focus e.g. technical, executive, compliance, or something else

- Don’t over-engineer the scenario and make it too complicated. Keep the discussion focused and steer away from technical rabbit holes or arguments around how realistic or likely elements of the scenario are. If possible, link the scenario to findings from audits, penetration tests, or other conditions that could lead to loss

- Embrace curveballs – ensure that the scenario does not take place purely under ideal conditions

- Design it to use the time you have – if a four-hour exercise is logistically impossible, consider a one-hour drill to provide a quick-hit education and experience

- Use an experienced facilitator for the tabletop exercise who can pivot from the script to extract value in the unplanned

- Lean into the good - avoid dwelling on what the team does wrong in an exercise. While there are frequently lessons to learn, too much focus on negatives can stymy discussion – there is more progress when participants are open with their thoughts and unfiltered with their reactions

- Make it one of many - Tabletops should build on previous ones, infusing education and experience like layers of paint.

This last point is important since organizations and teams change and even similar exercises can yield different results among different groups of employees or points in time. With clarity of purpose, conviction of approach, and expectation of participation, your tabletop exercise can deliver vital realistic scenario planning that can more effectively prepare your team for what may lie ahead.