Tabletop Exercises
Realistic intent scenarios to test your team
Prepare for potential cybersecurity incidents
Information Security breaches continue to afflict companies of all sizes and the need to be prepared for a potential cybersecurity incident is more important than ever.
One of the most effective ways to test and maintain an Incident Response program is by using Tabletop Exercises.
Tabletop Exercises present an organization with a realistic incident scenario to which they respond. Participants describe how they would react during the incident, what tools they would use, and what procedures would be followed.
TrustedSec has years of experience running Tabletop Exercises, having worked with many organizations to help design and run the exercises in order to test Incident Response plans and policies and ensure they are working as expected. As part of the exercise, TrustedSec will:
- Design relevant scenarios for the organization
- Act as the facilitator and moderator during the scenario
- Record all actions that occur during the exercise
- Evaluate the tools, procedures, and processes used to ensure they align with industry best practices
At the end of the exercise, the organization will be able to determine where the positive areas in their Incident Response plans and policies are, which areas have room for improvement, and how they can improve moving forward.
Learn more about our services from an expert.
Let our experts tailor solutions to your security challenges.
Read our blog
Explore the latest cybersecurity topics on the TrustedSec Security Blog
Hardening Intune: The Implementation Guide
Now that we've identified the blind spot, here's how to fix it. In Part 2 of our blog series, we deliver a phase-based implementation guide to hardening…
The Privileged Roles Nobody Talks About
MDM admins can deploy apps, or wipe every device in your fleet. Yet most treat them like standard IT roles. In Part 1 of this blog series, we break down the…
Shai-Hulud Is Back, and This Time It Ate the Whole Ecosystem
Same worm, different wave. In our new blog, Director of Security Intelligence Carlos Perez covers Shai-Hulud, how this supply-chain malware can eat your whole…
Slamming the Door on Quick Assist Tech Support Scams and Abuse
Tech support scams are simple by design—just a trusted tool and a convincing story. We break down Microsoft Windows Quick Assist as an attack vector, detection…
Building a Detection Foundation: Part 5 - Correlation in Practice
From Data Sources to DetectionWe've covered a lot of ground in this series: Windows Security events for logon tracking and process execution; PowerShell…
Building a Detection Foundation: Part 4 - Sysmon
Filling the Gaps Native Logging Can'tAt this point in our series, we have Windows Security events capturing logon sessions and process creation, and…
Building a Detection Foundation: Part 3 - PowerShell and Script Logging
The Second Most Important Data Source You're Probably Not CapturingIn Part 2, we enabled process creation logging with command lines. That's a big…
Building a Detection Foundation: Part 2 - Windows Security Events
The Audit Policies Nobody ConfiguresIn Part 1, we looked at why relying on a single telemetry source is a recipe for blind spots. Now let's get practical.…
Building a Detection Foundation: Part 1 - The Single-Source Problem
If your EDR goes dark, can you still see the attack? In the part one of a five part series, we go through the risks of single-source visibility and why…
Adventures in Primary Group Behavior, Reporting, and Exploitation
Not all AD group membership is created equal. In this blog, we explore how the primaryGroupID attribute can be abused to hide privileges as well as how teams…