Incident response tabletop vs. hands-on exercise: what each measures
A tabletop and a hands-on exercise are both called incident response training, and they measure almost nothing in common. One tests whether a team can decide and communicate under pressure. The other tests whether an analyst can read the evidence and make the right call. A course needs both, in the right order, scored differently.
What a tabletop measures
A tabletop is a facilitated conversation. The facilitator reads a scenario in stages (an alert fires, a second host is affected, a journalist calls, the backups turn out to be encrypted), and the participants say what they would do. Nobody touches a console. The product is a record of decisions and the discussion that produced them.
What it measures, when run well:
- Decisions. Who declares an incident, and on what evidence. When to contain, and at what cost to the business. Whether to pay, to notify, to shut down.
- Roles. Whether people know who owns each call, and what happens when the owner is unavailable.
- Communication. What gets said to leadership, to legal, to customers, to the press, and when. Whether the technical team can describe the situation in a sentence a non-technical executive can act on.
- Gaps in the plan. A tabletop is the cheapest way to find out that the runbook assumes a person who left last year.
What it doesn't measure is analytic skill. A student can perform brilliantly in a tabletop without being able to open an EDR console, because the facilitator supplies every fact. That's a feature, not a flaw; it's a different instrument.
What a hands-on exercise measures
A hands-on exercise hands the participant the evidence a responder would actually have, an EDR detection feed and a SIEM export, and asks the questions a responder actually has to answer. Which alert is the real one. What's the process tree under it. Which ATT&CK technique is this. What's the first host, the first time, the account. What are the indicators to block. Is it contained if we isolate this one machine, or is there a second foothold.
It measures analysis, timeline construction and the containment call. It can be graded objectively, because the answers are facts in the evidence: an indicator set, an ordered sequence of attacker steps, a technique ID, a severity, a yes or no on whether containment is complete. Our incident response cases are built this way, with answer types for each of those shapes. First Look: Reading a SIEM Alert is the on-ramp: one SIEM export, a short stack of alerts, sort by severity and escalate the right one cleanly. Fire Drill is the other end: a clock-driven ransomware drill where the EDR feed and SIEM queue are both open, the locker is live, and the NIST 800-61 phases have to be worked in order inside 45 minutes.
What a hands-on exercise doesn't measure well is the organizational layer. A student alone with a SIEM export doesn't have to brief anyone, and the containment call is a checkbox rather than a negotiation with the business owner of the server.
Run the tabletop to find out whether they can decide. Run the hands-on exercise to find out whether they can see. Then run the tabletop again on the incident they just worked, and watch the decisions change.
How to run both in a term
The order matters. Here's one way to fit both into eight weeks. The hands-on weeks follow the shape of our 8-week Incident Response Fundamentals pack; the tabletops are yours to add.
- Week 1 or 2: a short tabletop. Forty-five minutes, a simple phishing-to-malware scenario, groups of four. The goal is vocabulary and roles: what an incident is, who declares it, what the phases are. Students who have never seen a SIEM can do this, and it gives them a frame to hang the evidence on.
- Weeks 2 to 6: hands-on, climbing. First Looks at an EDR alert and a SIEM alert, then medium cases where the two have to be correlated, then a case where the containment call is a real question. One case a week, each student on their own variant of the evidence, graded against a verified key. The EDR and SIEM exercise post describes what a case like this contains.
- Week 7: the drill. A timed hands-on exercise against a clock. Fire Drill, or something like it. This is the summative analytic assessment.
- Week 8: the tabletop, again. Same groups, and this time the scenario is the incident they just worked in the drill. Now the facilitator doesn't have to supply the facts; the students have them. The decisions get sharper, the communication gets more specific, and the difference between the week 1 tabletop and this one is the clearest evidence you'll get that the term worked.
If the term is longer, add tabletops after each difficulty step rather than more of them at the start. A tabletop is most useful when the participants have just been inside the evidence.
How to score them
Score the two differently, and tell students in advance that you will.
Tabletop: a rubric, applied to the group and to the individual, with the facilitator's notes as the record. Four criteria work:
- Decision quality. Was each call made on the evidence available at that stage, and was the reasoning stated? Credit a defensible wrong call over a correct guess.
- Timeliness. How many injects passed before the incident was declared, before containment was ordered, before leadership was told.
- Communication. Ask each group to produce one written artifact under time: a three-sentence executive update, or a holding statement. Grade it for accuracy, clarity and the absence of speculation.
- Role discipline. Did the right person make each call, and did the group notice when they didn't?
Hands-on exercise: an auto-graded answer key with partial credit where the answer has parts. Indicators are scored as a set (fraction found, with extra items flagged for review). The attacker sequence is scored on the longest run of steps in the right relative order. An ATT&CK answer that gives the parent when the key is a sub-technique is accepted and flagged for review. Severity and containment are a single right-or-wrong call, which is as it should be; a responder doesn't get partial credit for half-isolating a host. Every score carries its reason. In Red Herrings the whole class is graded this way from one screen and the result exports to the LMS, with per-student evidence so that a copied indicator list is wrong.
Keep the weights honest. If the tabletop is 15 percent of the grade and the drill is 25, say so, and say why: one is a group judgment exercise scored by a person, the other is an individual analytic exercise scored against the evidence. Students accept different instruments when they understand what each one is for.
Run the free First Look cases or download the sample lab, or start the 30-day trial with sample cases to try, and generate a per-student case.
