Tabletop Exercises + Phishing Simulation Training 2026
Run tabletop exercises alongside phishing simulation training in 2026 with a step-by-step MSP playbook, scenario templates, and compliance-ready evidence.
DefendWise
DefendWise
Phishing simulation training tells you who clicked. Tabletop exercises tell you what happens after someone clicks — and for most MSP clients in 2026, that second answer is the one nobody has tested.
TL;DR
- Pair monthly phishing simulation training with a quarterly tabletop exercise to test detection, reporting, and response together.
- A 60-90 minute tabletop costs almost nothing beyond staff time and produces compliance evidence auditors actually want.
- Feed real click-rate and reporting data from phishing simulations into the tabletop scenario instead of writing a generic script.
- Skip tabletop exercises for clients under 15 seats in 2026 — run a shorter incident walk-through instead.
- DefendWise reporting exports give MSPs the click and report data a tabletop facilitator needs in minutes, not hours.
Why this matters
Simulated phishing tests one behavior: does the employee click. It does not test whether the help desk recognizes an incident, whether IT contains a compromised account fast enough, or whether leadership knows who makes the call to notify a client of a breach.
Cyber insurance carriers and compliance frameworks in 2026 are asking for both. Security awareness training programs that only run simulated phishing campaigns show detection data. Programs that add a tabletop exercise on top show detection and response — and that's the evidence auditors and insurers increasingly want to see side by side.
MSPs running phishing simulation campaigns already have the click data. The gap is turning that data into a scenario the client's team actually rehearses.
What you'll need
- Click-rate and reporting data from the last 2-3 phishing simulation cycles
- A 60-90 minute meeting block with the client's IT lead, one department manager, and one executive sponsor
- A written incident response plan, even a one-page version, as the scenario's backbone
- A facilitator who isn't the person being tested — usually the MSP account manager or vCISO, not the client's own IT staff
- A whiteboard or shared doc to capture decisions and gaps in real time
- No new software purchase required — the simulation platform you already run supplies the scenario data
The steps
1. Pull the last quarter of phishing simulation data
Start with numbers, not a hypothetical. Pull click rate, report rate, and time-to-report from the client's last 3 months of simulated phishing campaigns.
If 22% of the finance team clicked a fake invoice email in the last simulation, that's your tabletop's opening scene. Real numbers make the exercise credible instead of theoretical, and they show the client you're building on data they already paid for.
Common mistake: running a generic "ransomware hits the network" scenario that has nothing to do with the client's actual click patterns. Ground the story in their data or the exercise feels like a training video.
2. Write a one-page scenario, not a script
Draft a single incident narrative: what email arrived, who clicked, what happened next, and where the story stops for discussion. Keep it to one page — a facilitator reading from ten pages of script loses the room in the first five minutes.
Example scenario structure for 2026 clients: an employee in AP receives an invoice email spoofing a known vendor, clicks, and enters their Microsoft 365 credentials on a fake login page. Stop there and ask the room what happens next.
3. Run the exercise in three timed segments
Break the 60-90 minutes into three blocks: detection (15 minutes), containment (30 minutes), and communication (15-30 minutes). Each segment ends with a specific question: who noticed, who acted, who got told.
Timing the segments keeps the exercise from turning into an open-ended discussion that runs 3 hours and exhausts everyone in the room. Expected outcome: a documented timeline showing exactly where the client's process has a gap — usually in the containment segment, where nobody is sure who has authority to disable an account.
4. Test the incident response plan against the scenario
As the group works through the scenario, check every decision against the client's written incident response plan. If the plan says notify IT within 1 hour but the room can't agree who counts as IT, that's a finding, not a footnote.
Most clients in 2026 have a plan that was written once and never rehearsed. The tabletop is the only place that gap shows up before a real incident does.
Common mistake: treating the incident response plan as background reading instead of the thing being tested. The plan is the object under test, not the reference material.
5. Score the response, not just the click
Define three to five criteria before the exercise starts: time to detect, time to report, time to contain, and time to notify. Score each one on a simple scale — met, partially met, missed — during the debrief, not from memory a week later.
A client that clicked at 22% but contained the incident in 40 minutes is in better shape than a client that clicked at 8% but took 6 hours to figure out who owned the response. The tabletop tells you which client actually needs the attention.
6. Document the gaps as a one-page action list
End the session with a short, specific list: three to five gaps, an owner for each, and a date. "Nobody knew who could disable a compromised account outside business hours" is a finding. "Improve security culture" is not.
This document is also compliance evidence. Insurers and auditors want to see that a client tested their response process, not just their employees' click behavior — cyber insurance requirements increasingly ask for exactly this kind of artifact.
7. Report the combined results to leadership
Present phishing simulation data and tabletop findings together, not as two separate reports six months apart. Executives care about one number: how exposed is the organization right now, tested end to end.
When communicating phishing simulation results to leadership, add the tabletop's timeline finding to the same slide. A 22% click rate paired with a 40-minute containment time tells a more complete story than either metric alone.
8. Schedule the next tabletop before you leave the room
Book the follow-up date on the spot — quarterly for clients in regulated industries, twice a year for everyone else in 2026. An exercise that isn't scheduled again inside 12 months rarely happens a second time.
Troubleshooting
- Nobody shows up from leadership. Reschedule rather than run it without an executive sponsor — the containment and notification segments need someone with authority to make decisions in the room.
- The IT lead gets defensive during the containment segment. Reframe out loud: this tests the process, not you. A facilitator who is also the client's employee can't run this segment credibly.
- The scenario feels too easy and wraps in 20 minutes. Add a complication mid-exercise — the compromised account also has access to a shared finance drive — to force a second decision point.
- The client has no written incident response plan to test against. Build a one-page draft together during the exercise itself; a rough plan tested once beats a polished plan tested never.
- Findings get documented but never actioned. Put an owner and a date on every gap before the meeting ends, and follow up in writing within 48 hours.
- Results don't match the phishing simulation data at all. Check whether the simulation campaign ran recently enough to be representative — data older than 90 days rarely reflects current behavior.
Tools and resources
- Click-rate and time-to-report exports from the client's active phishing simulation program
- The client's written incident response plan, or a one-page draft built during the session
- A cyber risk assessment from the last 12 months, if one exists, to prioritize which scenario to run first
- A shared document or whiteboard for real-time gap capture
- DefendWise's reporting dashboard for pulling click, report, and campaign history data in minutes rather than digging through spreadsheets
Run phishing data and tabletops together
See how flat-fee reporting exports feed both programs at once.
What to do next
Run the first tabletop within 30 days of your next phishing simulation cycle while the click data is still fresh. Then build a repeatable one-page template so every client tabletop takes an hour to prep instead of a full day.
FAQ
What is a tabletop exercise in cybersecurity?
A tabletop exercise is a facilitated discussion where a team walks through a simulated security incident step by step to test detection, response, and communication. It doesn't touch live systems — it's a conversation, usually 60-90 minutes, that exposes gaps in a written incident response plan before a real breach does.
How often should MSPs run tabletop exercises alongside phishing simulation training?
Run tabletop exercises quarterly for clients in regulated industries and twice a year for everyone else in 2026. Phishing simulations run monthly or more; the tabletop is a lower-frequency check on whether the response process actually works.
Do tabletop exercises replace phishing simulation training?
No, they test different things. Phishing simulation training measures whether employees click and report; tabletop exercises measure whether the organization detects, contains, and communicates once someone already has. Run both — one without the other leaves half the risk untested.
How long does a tabletop exercise take to run?
A focused tabletop exercise runs 60-90 minutes when broken into detection, containment, and communication segments. Longer sessions tend to lose the room; keep the scenario to one page and time each segment.
What data should feed a phishing tabletop exercise scenario?
Use the client's actual click rate, report rate, and time-to-report numbers from the last 2-3 phishing simulation cycles. A scenario built on real numbers is more credible to the room than a generic ransomware story with no connection to the client's behavior.
Is a tabletop exercise required for cyber insurance in 2026?
Most cyber insurance applications don't name tabletop exercises explicitly, but carriers increasingly ask for evidence of tested incident response, not just training completion. A documented tabletop with dated findings is stronger evidence than a training certificate alone.
Who should facilitate a tabletop exercise for an MSP client?
The MSP account manager or a vCISO should facilitate, not the client's own IT lead being tested. An outside facilitator keeps the containment segment honest and prevents the exercise from turning defensive.
What size client needs a full tabletop exercise?
Clients above roughly 15-20 seats get the most value from a full tabletop; smaller clients often do better with a shorter 30-minute incident walk-through instead of the full three-segment format.
One last thing
The most common finding across 2026 tabletop exercises isn't a technical gap — it's that nobody in the room can name who has authority to disable a compromised account after hours. That single question, asked once in a 90-minute session, prevents more damage than another round of phishing simulation training alone.