C3SA designs and facilitates cyber tabletop exercises that test leadership, communications, escalation, legal, technical and operational decision-making under realistic pressure.
Our work is designed around practical outcomes, not activity for its own sake.
Business disruption, extortion, recovery and stakeholder decisions.
Privacy, legal, communications and containment decisions.
Operational disruption and cyber-physical consequence scenarios.
Third-party compromise, vendor dependency and cascading impact.
Board and executive decision-making under uncertainty.
Scenarios based on the organization, sector, architecture and threat profile.
A tabletop exercise is a facilitated discussion of a realistic incident, where participants work through decisions as new information (injects) arrives.
Business disruption, extortion and recovery decisions: what to shut down, whether and how to engage with the attacker, when to notify, and how to restore.
What you get
Privacy, legal, communications and containment decisions after sensitive data is stolen, including notification obligations.
What you get
Operational disruption and cyber-physical consequences, with safety and continuity decisions alongside cyber response. See OT/ICS exercises.
What you get
Compromise of a supplier or software provider, vendor dependency and cascading impact on your operations.
What you get
Board and executive decision-making under uncertainty, time pressure and public scrutiny. See Executive & Board Training.
What you get
Scenarios built from your organization, sector, architecture and threat profile.
What you get
Engagements can be targeted, project-based or part of a broader transformation program.
Plans often look complete on paper while roles and decisions remain untested. C3SA facilitates plausible incidents with realistic injects, cross-functional discussion and explicit decision points, so gaps surface in a room rather than during a crisis.
Every exercise ends with a record of what happened and prioritized corrective actions. C3SA can then help fix the gaps and run a follow-up exercise to confirm the improvement.
Executives plus the functions that decide during an incident: IT and security, legal, privacy, communications, operations and, where relevant, HR and finance.
Common formats are 90 minutes, a half day or a full day. The Tabletop Exercise Planner helps you choose.
An exercise record, the role and communication gaps observed, and a prioritized list of corrective actions with owners.
Plans look complete on paper, but roles and decisions are untested.
C3SA facilitates plausible incidents with injects, cross-functional discussion and explicit decision points.
An exercise record, role and communication gaps, and prioritized corrective actions.
A planning guide for executive and technical ransomware exercises that test decisions, communications, recovery and business continuity.
