Cyber security tabletop exercises are one of the most reliable tools for stress-testing an incident response plan before a real crisis forces the issue. But most guidance on how to run them assumes everyone is in the same room. That assumption breaks down fast when your incident response team is distributed across home offices, interstate sites, and third-party vendors dialling in from different time zones.
The core logic of a tabletop doesn't change with remote delivery. You present a scenario, walk participants through a sequence of injects, observe how decisions get made, and capture the gaps. What changes is almost everything around that core: the way communication breakdowns surface, who goes quiet, how body language disappears as a signal, and whether the tools people rely on during the exercise are the same tools they'd actually use in an incident.
The communication collapse problem
In a room, a facilitator can see when the CISO and the legal counsel are talking past each other. On a video call, that conversation often happens in a chat sidebar, or not at all. Participants who are hesitant to speak up in person become nearly invisible in a remote format. The result is that tabletop findings skew toward the people confident enough to dominate a Zoom call, not the people who actually own the processes that matter.
One concrete fix: assign a second facilitator whose only job is to monitor the chat, watch for participants who haven't spoken, and inject direct questions at them. Not "does anyone have thoughts on this?" but "Priya, you own the vendor contracts, what's your read on the containment decision?" This mimics the deliberate polling that good in-person facilitators do naturally, but has to be made explicit in a remote session.
The other gap is escalation. Remote exercises often reveal that teams don't actually know how they'd reach each other in a real incident if primary communication tools went down. This is worth turning into an inject directly: simulate Slack being unavailable at a critical moment and watch what happens. Most teams haven't tested this. Most teams discover they haven't tested it during an actual incident.
Tool fidelity: running the exercise on the wrong platform
A tabletop run on Microsoft Teams when the organisation's incident response runbook specifies a different war room tool is testing the wrong thing. Remote exercises introduce a temptation to use whatever video platform is already open, but the communication tools used in the exercise should match the tools specified in the incident response plan. If they don't match, the exercise is partly testing improvisation rather than preparedness.
This connects to a deeper issue that forensic investigations frequently expose: teams often discover during an actual breach that their logging, alerting, and communication tools don't talk to each other the way the documentation says they do. A remote tabletop is an opportunity to test that integration before it matters. Run the exercise in the actual incident response tooling. If that tool is a ticketing system, open a real ticket. If it involves a dedicated incident channel in a comms platform, create one for the exercise.
Scenario design for distributed teams
Scenarios need adjustment for remote delivery in two specific ways. First, the scenario itself should include elements that stress remote coordination, not just technical response. A ransomware scenario where the injects include "your VPN is unreachable" or "three key responders are in different time zones and one has just gone offline" tests the real conditions a distributed team would face. A scenario that assumes everyone can immediately convene and discuss doesn't.
Second, the pace of injects needs slowing down. In a room, a facilitator can read the energy and know when to push the next inject. On a video call, that read is harder. Push the next inject too quickly and participants haven't finished processing the previous one. The resulting decisions look worse than they are, which produces misleading findings. Slow the cadence by roughly 20 percent compared to in-person delivery and build in explicit "decision checkpoints" where the facilitator asks for a stated position from each key role before moving on.
Who needs to be in the room (virtually)
Remote delivery makes it easier to include participants who'd be logistically difficult in a physical session: external legal counsel, PR advisors, the cloud vendor's incident response contact, board members. This is one of the genuine advantages. Use it. A tabletop that includes the CEO and general counsel will produce very different findings from one that's limited to the security and IT operations team, and the former is far more useful for testing decision authority and escalation paths.
The inclusion of vendors is worth particular attention. Supply chain compromises now frequently originate in third-party environments, and third-party risk management is one of the areas where Australian IT teams most consistently underperform. A tabletop that includes a key vendor's security contact under a supply chain breach scenario will reveal communication gaps that internal-only exercises miss entirely.
Capturing findings when you can't see the room
Debrief quality drops sharply in remote sessions if it isn't structured deliberately. The natural conversation that happens when people are packing up in a physical room, the informal "we really struggled with X" moments, don't happen on a video call where people leave the meeting immediately. Schedule a second, shorter debrief session 48 hours after the exercise. This gives participants time to reflect, and the written notes from the exercise are still fresh enough to be useful.
Assign someone to document decisions in real time during the exercise itself, not just observations. Capture exactly what decision was made, by whom, and at what point in the scenario. This is harder in a remote session because the facilitator is managing more, but it's the difference between a useful after-action report and a vague set of impressions. A shared document with edit access for one designated scribe, visible to all participants during the session, works better than retrospective note reconstruction.
Frequency and scope for Australian organisations
The ACSC's guidance on incident preparedness recommends testing response capabilities regularly, not as a once-yearly compliance exercise. Remote delivery, precisely because it removes logistical friction, makes more frequent and more targeted exercises practical. A full-team, multi-hour tabletop is appropriate once or twice a year. Shorter, scenario-specific exercises focused on a single incident type, run with smaller groups, are realistic to do quarterly.
Ransomware, business email compromise, and cloud misconfiguration incidents are the three scenarios most worth cycling through for Australian organisations based on current threat patterns. Each tests a different combination of technical response, communication, and decision authority. Running them separately with the specific teams who'd actually own that incident type produces more actionable findings than running a generic scenario with everyone in the organisation.
The logistics of remote delivery are genuinely simpler than in-person. The facilitation is harder. Teams that treat a remote tabletop as "just put the same exercise on Zoom" will get findings that are thinner and less reliable. The gap is in deliberate structure, not in the scenario itself.