Your First Exercise

Step-by-step guide to creating, configuring, running, and debriefing your first tabletop exercise on After Action.

This guide walks you through the complete lifecycle of a tabletop exercise — from creation through debrief.

Prerequisites

• An active organization with at least one engagement created
• At least one team member with the ops role to facilitate
• Participant email addresses for invitations

Step 1: Create the Exercise

1. Navigate to your engagement in the Ops Portal.
2. Click New Exercise to open the Exercise Builder.
3. Fill in the exercise name, scheduled date, and expected duration.
4. Select a status — leave it as draft until you are ready to schedule.

Step 2: Choose a Scenario

Select from the built-in scenario library or create a custom scenario. Each scenario includes:

• Threat actor profile — Motivation, capability level, and attack vector
• Attack narrative — The storyline that unfolds during the exercise
• Pre-built injects — Timeline events mapped to NIST 800-61 phases

For your first exercise, the Ransomware Incident scenario is recommended. It covers detection, escalation, containment, communications, and recovery phases.

Step 3: Configure Injects

Injects are the events delivered to participants during the exercise. Each inject has:

| Field | Description | |---|---| | Title | Short description of the event | | Category | detection, escalation, containment, communications, recovery, or legal_regulatory | | Severity | critical, high, medium, low, or info | | Trigger time | Minutes from exercise start | | Expected response | What a mature team would do |

You can use inject templates from the library or create custom injects.

Step 4: Define Objectives

Add 3 to 5 measurable objectives for the exercise. These are evaluated during the debrief and feed into the readiness score. Examples:

• Detect and classify the threat within 15 minutes of initial indicators
• Escalate to executive leadership within the defined threshold
• Activate containment procedures per the incident response plan

Step 5: Invite Participants

Add participants by email. Each participant receives a link to the Participant War Room where they will see injects, submit decisions, and receive AI coaching.

Step 6: Run the Exercise

1. Move the exercise status to scheduled, then in_progress when ready.
2. Open the Facilitator Control Room to manage the session.
3. Deliver injects on schedule — the control room shows a timeline view.
4. Monitor participant decisions and AI coaching responses in real time.
5. Capture gaps as they emerge using the gap tracker.

Step 7: Debrief and Generate Deliverables

After completing the exercise:

1. Review the auto-generated Readiness Score across 8 dimensions.
2. Open the AAR Editor to compile findings, observations, and action items.
3. Generate deliverables — IR Playbook, Executive AAR, Gap Remediation Plan.
4. Share results with the client through their portal.

The client will see their readiness score, gap analysis, and deliverables in the Client Portal immediately after you publish them.