Incident Response Tabletop
Your team, your escalation paths, a breach that unfolds in real time. The value is not the scenario — it is discovering which handoff stalls, which decision nobody owns, and which number in the runbook is wrong.
This workshop is no longer offered as a scheduled open session. The material now runs inside our weekend cohorts, which have published dates and seats you can book today. It is still available as a private session for a single team or institution.
See the weekend cohorts →- Format
- Half day · team exercise
- Duration
- Half day · facilitated
- Who it is for
- Security teams and incident responders
What you leave able to do
- Run a breach end to end against your real escalation paths
- Find the handoffs that stall and the decisions nobody owns
- Leave with a written after-action review, not a slide deck
Run of play
- 1
Injection
The first signal, delivered the way it would really arrive.
- 2
Escalation
The exercise follows your runbook, including where it breaks.
- 3
After-action review
Written up as findings and owners before anyone leaves.
What runs now
This format now runs as a dated cohort
The material from this workshop is taught across the AI SOC Analyst weekend cohort, which has published dates and seats you can book today.
Sat 17 Oct 2026
Foundations and the first alert
Sat 24 Oct 2026
AI-era phishing and the initial foothold
Sat 31 Oct 2026
Endpoint investigation and containment
Sat 14 Nov 2026
Cloud SOC and lateral movement
Sat 21 Nov 2026
Detection engineering and automation
Sat 28 Nov 2026
Immersive day and certification exam
Or take the full programme
Six Saturdays live, plus three months of the complete lab course.
Other courses running now
Prerequisites
An existing security team and at least a draft incident response process.
Want this run for your team?
Sessions are scoped to the audience — a placement cell, a security team and a leadership group each need a different shape. Tell us who it is for and we will come back with a format and a date.