Original Research
Findings from 150+ Incident Response Tabletop Exercises
The largest body of executive-tabletop primary research published by a single practitioner. Calibrated for the C-Suite, board, and the leaders who have to act on the findings.
About This Research
Between 2019 and 2026, Mark Lynd facilitated more than 150 executive incident response tabletop exercises across school districts, mid-market manufacturers, enterprise organizations, healthcare systems, financial institutions, energy and utility operators, transportation organizations, retail, technology, and federal, state, and local government agencies.
The data below is aggregated, anonymized, and reflects patterns observed across multiple organizations rather than any single engagement. Findings are presented at the level of detail useful for executive decision-making and board reporting, not for technical IR practitioners. For practitioner-grade detail, see the 72-Hour IR Executive Playbook article.
Methodology: Each tabletop exercise included the actual executive leadership team of the host organization (CEO, COO, CFO, CIO, CISO, General Counsel, head of Communications, and audit committee chair where applicable). Findings are categorical and based on observed behavior under simulated pressure, not survey responses.
Executive Summary
The five findings the C-Suite and board should know.
Finding 1
Technical maturity does not produce coordination maturity
Organizations with sophisticated SOC tooling consistently fail the executive coordination test. The gap is independent of cybersecurity spend.
Finding 2
The first 6 hours determine the next 72
Authority disputes, parallel narratives, and missed regulator clocks in the first 6 hours compound across the response. Most events that became material had executive coordination failures in hour one.
Finding 3
18 to 36 hours of recoverable response time is the typical gap
The average organization that runs an executive tabletop surfaces 18 to 36 hours of recoverable response time that would have been lost in a live incident. That gap has direct financial and regulatory consequence.
Finding 4
Cyber insurance posture is rarely understood at the C-Suite level
Most executive teams cannot cite their notification window, social-engineering coverage conditions, or ransomware sub-limits without checking the policy document during the exercise. By that point, the claim is already at risk.
Finding 5
AI-enabled threats have moved into the first quarter of 2026 incident response
Deepfake voice fraud, AI-generated spear phishing, and prompt injection scenarios now appear in real incidents, not just hypotheticals. The defender side is behind. Most organizations have no playbook for the attack categories their employees encountered in the last 90 days.
Incident Command Failures
The named incident commander is the single most important role in the first six hours. The data on whether organizations have one ready is consistently worse than executives expect.
| Finding | Rate |
|---|---|
| Participants could not name their incident commander when asked at exercise start | 89% |
| Escalation chain contained phone numbers that no longer connected to the intended person | 73% |
| Designated incident commander was the CISO (a structural mistake, since the CISO is needed in the technical room) | 64% |
| No documented successor if the named commander was unavailable | 76% |
What This Means for the C-Suite
The executive incident commander should be the COO, General Counsel, or Chief of Staff, not the CISO. The role needs to be named in writing, with a documented successor and tested communication channels. This is a 90-minute decision the executive team can make on a calm afternoon. It is the single most expensive decision to defer.
Authority and Decision-Making
Most incident response runbooks describe tasks. Very few describe decision authority. When authority is ambiguous, teams default to consensus, and consensus does not hit a four-hour regulatory clock.
| Finding | Metric |
|---|---|
| Average time spent resolving the first authority dispute during the exercise | 14 min |
| Could not confirm who has authority to take production systems offline | 93% |
| No pre-decided ransom posture on file before the exercise | 81% |
| Could not name authority threshold for customer notification | 71% |
What This Means for the C-Suite
Ransom posture (pay, do not pay, or depends-on-these-conditions) should be on file before any incident. Debating it for the first time at hour nine, with a stranger from a forensics firm on speakerphone, is the most expensive Phase 2 failure pattern.
Backup and Recovery Readiness
Backup tooling has matured. The discipline around testing, isolation, and credential separation has not kept pace. Most organizations discover the gap during recovery, when it is most expensive to discover.
| Finding | Rate |
|---|---|
| Had not tested backup restoration in the previous 6 months | 87% |
| Backup systems shared credentials with the production environment they were meant to protect | 53% |
| Recovery time objective (RTO) on paper differed materially from realistic tested RTO | 68% |
| No documented restoration sequence (which system comes back first) | 58% |
What This Means for the C-Suite
A restoration sequence is a business decision, not a technical one. The CFO and CEO should know which systems come back first and why, because the ordering has revenue, regulatory, and customer-trust implications. Document the sequence before the incident requires it.
Cross-Functional Coordination
Modern incident response is a multi-function discipline. Security, Legal, Communications, Finance, HR, and Operations all have decision authority at different points in the timeline. Most organizations do not bring those functions together until an actual incident forces it.
| Finding | Rate |
|---|---|
| First time Legal and Communications teams participated in an IR exercise | 83% |
| No pre-drafted holding statement for press or customers | 79% |
| CEO had not been pre-briefed on the press protocol before going on a live press call | 66% |
| Multiple parallel narratives formed (Slack thread, executive text, Legal email) by hour 6 | 94% |
What This Means for the C-Suite
The CEO is the highest-risk speaker in the first 72 hours because they hold the most authority and the least context. Pre-brief the CEO. Lock the press protocol. Collapse parallel narratives into one source of truth by hour six or accept that the response is already drifting.
Cyber Insurance and Regulatory Readiness
Cyber insurance has matured into a real underwriting partner. SEC disclosure rules have hardened the disclosure window. Most executive teams cannot cite their notification timelines without checking the policy document, and by that point the claim is at risk.
| Finding | Rate |
|---|---|
| Could not cite cyber insurance notification timeline from memory | 91% |
| Did not know their social-engineering coverage condition (verification procedures required for payout) | 84% |
| Could not produce a regulatory clock dashboard covering SEC Item 1.05, GDPR Article 33, HIPAA, and state breach laws simultaneously | 88% |
| Did not know their ransomware sub-limit and co-insurance structure | 77% |
What This Means for the C-Suite
The CFO and General Counsel should know the cyber insurance policy as well as the broker does. The Cyber Insurance Readiness Score is the framework Mark uses to score submission readiness, underwriting controls, claim discipline, and incident response coordination on a single combined index. It aligns the CISO, CFO, GC, and broker before the next renewal.
AI-Enabled Attack Readiness
AI-enabled attack patterns have moved from threat-briefing category to first-quarter incident category. Most executive teams have no documented response for the attack types their employees encountered in the last 90 days.
| Finding | Rate |
|---|---|
| Had no documented playbook for AI-generated voice fraud against the CFO or treasury team | 87% |
| Had never practiced a scenario where the defensive AI tool was compromised | 92% |
| No 60-second kill switch tested for production AI agents | 85% |
| No prompt injection red team exercise conducted on agents that process external data | 90% |
What This Means for the C-Suite
Executives are the highest-value targets for AI-enabled attacks. The CEO's voice is the most likely to be cloned. The CFO's verbal authorization is the most valuable to forge. Build out-of-band verification for any action that could be initiated by a clone of an executive voice. Mandate a tested 60-second kill switch for every AI agent in production.
Board and Executive Reporting
SEC cybersecurity disclosure rules require the board to be in the loop on material incidents in close to real time. Most organizations are not structured to produce board-grade updates inside the regulator window.
| Finding | Rate |
|---|---|
| No documented board update template ready at hour 12 of the simulated incident | 82% |
| Audit committee chair did not have a documented role in incident response | 74% |
| CISO and CFO had not jointly reviewed material disclosure thresholds in the previous 12 months | 68% |
| No defensible decision record (timestamped, tamper-evident) of executive decisions during simulation | 79% |
What This Means for the C-Suite
A 200-word board update template ready before any incident is one of the highest-leverage investments the executive team can make. Six fields, three updates (hour 12, hour 24, hour 48). Without it, the board gets briefed late and the disclosure file becomes contested ground.
The 18 to 36 Hour Finding
The single most-cited finding from 150+ executive tabletop exercises.
The typical executive tabletop surfaces 18 to 36 hours of recoverable response time that would have been lost in a live incident.
Recoverable response time is the difference between when a decision should have landed and when it actually landed in the simulation. Each hour of drift costs the organization differently. Regulator-clock hours have disclosure consequence. Customer-notification hours have trust consequence. Restoration-sequencing hours have revenue consequence. Insurance-notification hours have coverage consequence.
In live incidents, the 18 to 36 hours show up as missed disclosures, delayed board updates, contested claims, and customer notifications that have to be revised three times before they go out. The exercise surfaces the gap before the incident does.
The exercise itself is what closes the gap. Organizations that run an executive tabletop annually consistently move from the 30-plus hour band into single digits over three to four exercises.
Quotable Findings
"Technical maturity and coordination maturity are independent variables. A world-class SOC inside an organization with ambiguous IR authority still fails the first-hour test."
Mark Lynd, after 150+ executive tabletop exercises
"The most expensive Phase 2 failure pattern is debating ransom posture for the first time at hour nine with a stranger from a forensics firm on the speakerphone."
Mark Lynd, on findings from 150+ tabletops
"In 94% of exercises, multiple parallel narratives form by hour six. By that point, the response is drifting and nobody is in command."
Mark Lynd, executive tabletop research 2019 to 2026
"AI-enabled threats are no longer a threat briefing category. They are a first-quarter incident category. 87% of executive teams have no documented response for the attacks their employees encountered in the last 90 days."
Mark Lynd, on AI-enabled attack readiness in 2026
"The executive incident commander should be the COO, General Counsel, or Chief of Staff. Never the CISO. The CISO is needed in the technical room. This is a 90-minute decision that the executive team can make on a calm afternoon, and it is the single most expensive one to defer."
Mark Lynd, the 72-Hour IR Executive Playbook
The Pattern That Repeats
Organizations invest heavily in security technology and underinvest in the human coordination layer. When an incident occurs, the gap between having a plan and being able to execute it under regulatory and reputational pressure is where breaches become catastrophic.
The 18 to 36 hours of recoverable response time that show up in nearly every tabletop are the same hours that determine whether an incident becomes material, the insurance claim pays cleanly, and the board update lands inside the regulator window.
An annual executive tabletop is the minimum cadence for organizations of any meaningful size. Quarterly is right for high-scrutiny environments. The exercise pays for itself in the first real incident.
Find Out Where Your 18 to 36 Hours Are
Mark facilitates executive tabletop exercises that surface the recoverable response time before a real incident does. Built around the 72-Hour IR Executive Playbook. Real executive team. Live decisions. Documented after-action review.
Available for in-person or virtual exercises
Half-day and full-day formats
Educational, nonprofit, and government rates available