Original Research
Findings from 150+ Incident Response Tabletop Exercises
The most comprehensive tabletop exercise dataset published by a single practitioner.
About This Research
Between 2019 and 2026, Mark Lynd facilitated over 150 incident response tabletop exercises across a broad range of organizations: school districts, mid-market manufacturers, Fortune 500 enterprises, healthcare systems, and government agencies.
The data below represents aggregated findings from these exercises. Each statistic reflects patterns observed across multiple organizations, not a single engagement.
Incident Command Failures
| Finding | Percentage |
|---|---|
| Participants could not name their incident commander when asked | 89% |
| Escalation chain contained disconnected phone numbers | 73% |
Authority & Decision-Making
| Finding | Metric |
|---|---|
| Average time to resolve first authority dispute during exercise | 14 min |
| Could not confirm who has authority to take production systems offline | 93% |
Backup & Recovery
| Finding | Percentage |
|---|---|
| Had not tested backup restoration in the previous 6 months | 87% |
| Backup systems shared credentials with compromised production environment | 53% |
Cross-Functional Gaps
| Finding | Percentage |
|---|---|
| First time legal and communications teams participated in an IR exercise | 83% |
| Could not cite their cyber insurance notification timeline requirements | 91% |
AI-Enabled Attack Readiness
| Finding | Percentage |
|---|---|
| Had no playbook for AI-generated voice phishing attacks | 87% |
| Had never practiced a scenario where their AI security tool was compromised | 92% |
The Pattern Is Clear
Organizations invest heavily in security technology but underinvest in the human coordination layer. When an incident occurs, the gap between having a plan and being able to execute it under pressure is where breaches become catastrophic.
Find Out Where Your Gaps Are
Mark facilitates tabletop exercises that expose the real gaps in your incident response capability. No slide decks. No theory. Live-fire simulations with your actual team.
Book a Tabletop Exercise →Available for in-person or virtual exercises
Half-day and full-day formats