A tabletop exercise turns your incident response plan from a PDF nobody has opened since it was signed into a rehearsed decision tree your team can run at 2 a.m. during a live ransomware event — but only if the tabletop exercise provider you hire builds a scenario that matches your actual attack surface, not a generic fire-drill script.
- Mandiant Incident Response Readiness is the best overall tabletop exercise provider for realistic 2026 breach simulations.
- CISA's Cyber Tabletop Exercise Packages (CTEP) are free and the best budget pick for small businesses.
- Arctic Wolf Incident Readiness fits best if you already pay for MDR or SOC-as-a-service.
- Unit 42 by Palo Alto Networks specializes in ransomware-specific tabletop scenarios.
- Run a tabletop exercise before you sign an incident response retainer, not after.
Why this matters
Cyber insurers in 2026 increasingly ask underwriting applicants to show evidence of a tested incident response plan, not just a written one. A plan that has never been rehearsed fails in the same predictable ways: legal freezes on breach notification language, IT restores from backups nobody checked, and the executive team argues about who calls the board instead of executing steps 1 through 10.
A tabletop exercise exposes those gaps in a conference room instead of during an actual incident response event, and it's the cheapest insurance policy most small and mid-sized businesses never buy. The right tabletop exercise provider maps the scenario to your real infrastructure — your EDR vendor, your cloud stack, your third-party vendors — instead of running a stock ransomware script that ignores how your business actually operates.
What makes the best tabletop exercise provider
- Scenario realism — the exercise reflects your actual attack surface: ransomware, business email compromise, insider threat, or a third-party vendor breach.
- Facilitator experience — the person running the room has led real incident response engagements, not just workshops.
- Compliance mapping — scenarios tie to frameworks you're already accountable to, like HIPAA or NIST 800-171.
- Post-exercise gap report — you leave with a written list of what broke and who owns fixing it, not a participation certificate.
- Integration with existing IR capacity — the findings feed directly into your incident response retainer so gaps get closed, not just documented.
- Accessibility for SMB budgets — many enterprise providers price for Fortune 500 security teams; a 40-person company needs a scaled-down version.
Tabletop exercise providers at a glance
| Provider | Best for | Standout feature | Key limitation |
|---|---|---|---|
| Mandiant (Google Cloud) | Enterprise-grade breach simulation | Threat-intel-informed scenarios built from real incident data | Custom quotes only, no published SMB tier |
| CISA Cyber Tabletop Exercise Packages | Budget-conscious small businesses | Free, government-built scenario templates | Generic scripts need customization for your environment |
| Arctic Wolf Incident Readiness | Existing MDR/SOC customers | Tabletop findings feed directly into your Arctic Wolf detection workflow | Least useful if you're not already a customer |
| Unit 42 (Palo Alto Networks) | Ransomware-specific scenario planning | Facilitators pulled from active ransomware negotiation cases | Narrower scope than a full-spectrum exercise |
| GuidePoint Security | Compliance-driven exercises | Scenarios explicitly mapped to HIPAA and NIST 800-171 controls | Consulting-heavy engagement model, longer lead time |
| SANS Institute | DIY facilitator training | Public templates and instructor-led courses to build in-house skills | You run the exercise yourself — no facilitator included |
1. Mandiant (Google Cloud) Incident Response Readiness: best tabletop exercise provider for enterprise-grade breach simulation
Mandiant builds tabletop scenarios from its own incident response caseload, so the ransomware negotiation timeline or supply-chain compromise your team walks through in 2026 reflects tactics attackers are actually using, not a textbook version from five years ago.
Mandiant pros:
- Scenarios draw on Mandiant's active threat-intelligence and incident response casework.
- Facilitators have run real breach investigations, not just simulations.
- Exercises can be scoped to specific threat actor profiles targeting your sector.
Mandiant cons:
- Pricing requires a direct sales conversation; nothing is published.
- The engagement model leans toward larger organizations with dedicated security teams.
Best for: companies that want the most realistic breach simulation available and have the budget for enterprise consulting. Verdict: Buy.
2. CISA Cyber Tabletop Exercise Packages (CTEP): best tabletop exercise provider for budget-conscious small businesses
The Cybersecurity and Infrastructure Security Agency publishes free tabletop exercise packages covering scenarios like ransomware and phishing-driven compromise, built for organizations with no dedicated security staff to run a first exercise without hiring a facilitator.
CISA CTEP pros:
- Completely free, publicly available scenario packages.
- Built by a federal agency with direct visibility into real attack trends.
- A reasonable starting point before hiring a paid provider.
CISA CTEP cons:
- Templates are generic and require internal customization to fit your environment.
- No facilitator or post-exercise reporting is included — you run it and score it yourself.
Best for: small businesses running their first tabletop exercise with no budget line for one. Verdict: Buy.
3. Arctic Wolf Incident Readiness: best tabletop exercise provider for existing MDR customers
Arctic Wolf's Incident Readiness offering ties tabletop exercise findings directly to the detection and response workflow you're already paying for, so a gap identified in the exercise room turns into an updated playbook inside your existing SOC relationship.
Arctic Wolf pros:
- Findings integrate with your existing Arctic Wolf detection and response service.
- Consistent point of contact if you already use their platform.
- Scenarios can reference your actual environment since the vendor already monitors it.
Arctic Wolf cons:
- Value drops sharply if you're not already an Arctic Wolf customer.
- Less useful as a standalone, vendor-agnostic exercise.
Best for: mid-market companies with an active Arctic Wolf MDR contract. Verdict: Buy.
4. Unit 42 (Palo Alto Networks): best tabletop exercise provider for ransomware-specific scenario planning
Unit 42 pulls facilitators from its ransomware negotiation and incident response practice, which makes its tabletop scenarios sharper on the specific decisions — pay, don't pay, notify, don't notify — that define a ransomware event rather than a generic breach.
Unit 42 pros:
- Facilitators bring direct ransomware negotiation and containment experience.
- Scenarios drill the exact decision points that stall response teams in real incidents.
- Strong fit if ransomware is your top-rated risk in 2026.
Unit 42 cons:
- Narrower focus than a full-spectrum exercise covering insider threat or vendor breach.
- Enterprise consulting pricing model, not built for a quick one-off session.
Best for: organizations that have identified ransomware as their primary threat scenario. Verdict: Hold — run one only after confirming ransomware, not BEC or insider threat, is your top exposure.
5. GuidePoint Security: best tabletop exercise provider for compliance-driven exercises
GuidePoint Security maps its tabletop scenarios directly to frameworks like HIPAA and NIST 800-171, which matters when the exercise doubles as evidence for an auditor or a compliance program rather than just an internal training exercise.
GuidePoint pros:
- Scenarios explicitly reference the controls in HIPAA and NIST 800-171.
- Consulting team can extend into broader compliance gap assessments.
- Documentation is built with an auditor's eye, not just an IT team's.
GuidePoint cons:
- Consulting-heavy engagement model means a longer lead time to schedule.
- Less focused on pure attack realism than compliance mapping.
Best for: healthcare, financial services, or defense contractors that need exercise evidence tied to a specific framework. Verdict: Buy.
6. SANS Institute: best tabletop exercise provider for building in-house facilitator skills
SANS Institute publishes public tabletop exercise templates and runs instructor-led courses that teach your own IT or security lead how to facilitate an exercise, which matters if you'd rather build the skill internally than outsource every year.
SANS Institute pros:
- Public templates cost nothing beyond your time.
- Instructor-led training builds a repeatable in-house skill.
- Good complement to a paid provider for annual refresher exercises.
SANS Institute cons:
- No facilitator is included — your own staff runs the session.
- Less realistic than a provider using live incident casework.
Best for: companies that want to run tabletop exercises annually without paying a consultant every time. Verdict: Hold — use this to train a facilitator, not as your first exercise.
How we ranked these tabletop exercise providers
Each provider above was weighed against the six criteria listed earlier — scenario realism, facilitator experience, compliance mapping, gap reporting, integration with existing incident response capacity, and SMB accessibility. No single provider wins on all six; that's why the list is built around distinct use cases instead of one leaderboard.
Which tabletop exercise provider should you choose in 2026?
If you've never run one, start with CISA's free CTEP templates to build the habit before paying for a facilitator. If ransomware is your board's top concern, Unit 42 drills the exact decisions that stall response teams. If you're already paying for MDR, Arctic Wolf turns the exercise into an update to a plan you're already running. For everyone else with budget and no strong bias toward a specific threat, Mandiant Incident Response Readiness stays the default pick for realism and depth.
Whoever runs the exercise, someone still has to own turning the findings into an updated plan — often a virtual CISO role if you don't have a full-time security leader on staff.
Ready to Test Your Incident Response Plan?
Cyber Solutions runs 24/7/365 incident response for 400+ businesses so exercise gaps get fixed, not filed.
FAQ
What is a cybersecurity tabletop exercise?
A tabletop exercise is a facilitated discussion where your team walks through a simulated cyberattack — like ransomware or a data breach — step by step to test your incident response plan. It exposes gaps in decision-making, communication, and technical response before a real attack forces you to find them live.
How much do tabletop exercise providers cost in 2026?
Costs range from free, using CISA's public CTEP templates, to custom enterprise engagements priced individually based on team size and scenario complexity. Providers like Mandiant and Unit 42 quote pricing directly rather than publishing a rate card.
Is CISA's tabletop exercise program really free?
Yes, CISA's Cyber Tabletop Exercise Packages (CTEP) are publicly available at no cost. You'll need internal staff to facilitate and customize the generic scenarios to fit your environment.
How often should a small business run a tabletop exercise?
At least once a year, with an additional exercise after any major infrastructure change like a new cloud migration or a merger. Annual testing is also what most cyber insurance underwriters now expect to see documented.
What's the difference between a tabletop exercise and a penetration test?
A penetration test attacks your systems technically to find exploitable vulnerabilities, while a tabletop exercise tests your people and process by simulating how your team responds to an incident. Most mature security programs run both, and pairing results with a penetration testing engagement closes gaps a tabletop alone won't surface.
Do cyber insurance providers require tabletop exercises?
Increasingly yes — many cyber insurance applications in 2026 ask for evidence of a tested incident response plan, not just a written one. Check your specific policy's underwriting questionnaire for the exact requirement.
Who should run the tabletop exercise, an outside provider or our own IT team?
An outside provider brings facilitator experience and unbiased scoring, which matters most for your first one or two exercises. Once your team has run a few, in-house facilitation trained through resources like SANS Institute can handle annual refreshers.
Can a managed IT or incident response provider also run tabletop exercises?
Some can, but it varies by vendor — confirm directly whether tabletop facilitation is included in an incident response retainer before assuming it is. Ask specifically what scenario library and reporting format they use.
One last thing
The most common tabletop exercise failure in 2026 isn't a wrong technical call — it's the legal, HR, and communications leads freezing because the scenario never scripted a role for them. Before you hire any provider from this list, confirm the exercise includes non-technical stakeholders, not just your IT and security staff, or you'll rehearse only half the incident.
