Tabletop exercises for cybersecurity, physical security and AI
We write the scenario around your organization, run the session with your team, then give you an after-action report with a fix list. It is a discussion exercise, so no systems are touched and nothing goes offline.
What an exercise finds
Most organizations find the gaps in their incident response plan during the incident. An exercise moves that discovery earlier, and the useful part is rarely the technical answer. It is finding out who gets called, who owns the decision, whether the phone list is current and how long the room needs to agree on anything.
Plans get written to meet a requirement and then sit in a shared drive. An exercise is where you learn whether the plan matches how your organization actually works, while there is still time to change it.
The scenario has to be one you could face. We build it from your systems, your facilities and the obligations you answer to, not from a template.
The scenarios we run
The exercises that teach the most usually cross between these, because real incidents do.
Cybersecurity
Ransomware in the systems you run on. A vendor breach that exposes your data. An intrusion nobody noticed for weeks. The session works the decision points: when you disconnect, who authorizes it, what you tell the public, when you ask for outside help and who you call. For election offices, a scenario can put an election management system down close to an election.
Virtual CISO servicesPhysical security
A break-in at a facility, an intruder in a restricted area, a threat against staff or a building system that fails in the middle of an event. The people who own the building and the people who own the network are usually not in the same conversation until something forces them into it.
Physical security consultingAI
Newer ground, and most teams have no plan for it yet. A staff member pastes sensitive records into a public chatbot, or a vendor turns on an AI feature nobody approved, or a convincing fake of an official starts circulating while you are trying to confirm whether it is real. We work through who decides, what gets said publicly and what your AI use policy requires, if you have one yet.
AI consultingCombined scenarios
The scenarios that teach the most cross the line between the two: a break-in at a water plant on the same night as a network compromise, an access control system that stops working because the network is down, or a deepfaked call to a facility manager that gets someone through a door.
Cyber and physical security usually sit in different departments under different bosses. Attackers already work both sides. A combined scenario puts both groups in the same room against the same incident, which is where you find out whether they can run a joint response.
Every consultant who works with Foundation Consultant Group served as a Cybersecurity Advisor with CISA, the federal field role for reducing cyber risk in state and local government and critical infrastructure.
- Six states CISA Region 5: Illinois, Indiana, Michigan, Minnesota, Ohio and Wisconsin, where Spencer Wood served.
- More than 20 years His record in enterprise, government and critical infrastructure.
- Nationwide Where we take engagements now.
Next step
Tell us the scenario that worries you and who would need to be in the room. We will scope the exercise and show you the cost before you commit to anything.
Get in Touch