Tabletop exercises and the anatomy of a solid post-breach plan
Australia's threat landscape has shifted decisively over the last three years. High-profile intrusions affecting Medibank, Optus, and a long list of critical-infrastructure providers have moved cyber response from a back-office concern to a board-level priority. Regulators responded in kind: the Notifiable Data Breaches scheme under the Privacy Act, APRA's CPS 234, and the Security of Critical Infrastructure (SOCI) Act now impose concrete obligations on local entities. The cumulative effect is that executives in Sydney, Melbourne, Brisbane, and beyond are expected to demonstrate not just strong controls, but credible playbooks for the hours and days after an attacker breaks through.
Tabletop exercises sit at the heart of that credibility. They force the abstract language of incident response into operational practice, exposing where escalation paths falter, where assumptions about tooling no longer hold, and where legal, communications, and technical teams have not rehearsed working together. Done well, they turn a binder of procedures into muscle memory. Done poorly, or skipped entirely, they leave organisations reacting for the first time when the clock is already ticking against them.
What follows is a practitioner's view of how to design and run exercises that genuinely sharpen a post-breach plan, with attention to the regulatory and operational realities specific to organisations operating across the country.
Why post-breach plans fail on paper
Most incident response documents look reassuring in a board pack and fall apart in the first hour of an actual incident. The reasons are predictable: they were written by a small group, reviewed rarely, and never tested against a scenario that resembles what an adversary would actually do. The Australian Signals Directorate has been blunt about this for years, and the Essential Eight maturity assessments still show that response readiness lags preventive controls across both government and industry.
A plan that names an incident commander but does not specify who deputises them during an arvo shift, or that lists a forensic retainer without confirming the firm's response SLA in writing, is little more than a wish list. Tabletop exercises are the cheapest, fastest way to surface these gaps before a regulator — or worse, an attacker — does.
A common pitfall is treating the playbook as a purely technical artefact. In practice, the failure points are usually human and procedural: an executive unsure whether they have the authority to take a customer-facing system offline, a legal team uncertain how the Notifiable Data Breaches scheme interacts with contractual notification clauses, or a comms lead who only learns about the existence of the plan when the first journalist calls. Exercises expose these seams with no production risk and modest cost, especially when compared with the financial and reputational fallout of a poorly handled incident.
Building realistic scenarios for Australian contexts
A useful scenario is not a Hollywood script. It is grounded in the threats that genuinely affect local organisations: ransomware against a mid-tier logistics operator in Western Australia, credential theft leading to fraudulent transactions at a regional credit union, a supplier compromise cascading into a healthcare network that already operates under heightened scrutiny, or a nation-state intrusion targeting intellectual property at an ASX-listed mining services firm. Each of these tests a different combination of technical, legal, and operational responses.
Scenarios should also vary in scale and sophistication. A simple data-exfiltration drill validates notification workflows; a multi-stage intrusion that escalates from endpoint to domain admin tests containment and eradication discipline; a scenario that combines a cyber event with a natural disaster — think a tropical cyclone shutting down a Brisbane data centre while the security team is responding to ransomware — strains business continuity and crisis communications simultaneously. Rotating through these formats prevents the team from rehearsing only the easy version of the incident.
Local regulators leave their own fingerprints on the script. APRA-regulated entities need to demonstrate CPS 234 reporting competence, SOCI obligations require specific ministerial liaisons, and scams referencing the ATO demand clear public messaging. Building these references into the scenario makes the exercise defensible at audit time and more useful for the participants who must live with the consequences.
| Exercise type | Participants | Primary goal | Typical duration |
|---|---|---|---|
| Discussion-based, single function | Security and IT only | Validate runbook | 2–3 hours |
| Discussion-based, cross-functional | Security, legal, comms, exec | Rehearse coordination | Half day |
| Operations-based, technical | Security with live isolation drills | Test detection and containment | 1–2 days |
| Executive crisis simulation | Senior leadership with timed injects | Stress-test board-level decisions | Full day, multi-stage |
Roles, communication trees, and decision-making under pressure
A tabletop is fundamentally a stress test of human coordination. The technical controls have either held or failed before the room gathers; what remains is the quality of decisions made under time pressure. Mature programmes assign roles explicitly: incident commander, scribe, legal counsel, communications lead, forensic liaison, business owner, and external counsel. Each role should be filled by name rather than job title, and deputies should be named too — a small but Australian-specific detail given how often senior staff are out of the country on leave.
Communication trees are where exercises tend to uncover the most embarrassing findings. Who calls the board? When does ASIC or APRA get notified? Is the CIO empowered to pull a production database offline without sign-off from the CFO? What does the holding statement say when the press has already heard from a competitor? The exercise forces these answers out of abstract politeness and into concrete commitments, ideally recorded against a version of the plan that everyone in the room can edit.
Decision rights matter as much as responsibilities. In many Australian organisations the legal function is conservative by design, which can slow containment while remaining perfectly defensible at trial. Rehearsals create the space to negotiate those trade-offs in advance, so that during a real event the participants are debating novel facts rather than re-fighting old arguments. Many teams also use the exercise to confirm tooling boundaries — which segments the EDR covers, which the network team can isolate, and where continuous cyber risk visibility actually accelerates triage rather than drowning responders in alerts.
Measuring maturity and tracking improvements over time
A single workshop delivers anecdotes; a programme of workshops, run quarterly or twice a year against a tracked improvement backlog, delivers measurable resilience. The starting point is an honest baseline: how long does it take to convene the response team, to confirm the scope of an incident, to decide on containment, and to issue a holding statement? These numbers are easy to capture, hard to argue with, and remarkably stubborn without deliberate practice.
Maturing beyond the second quarter of running exercises usually requires investment in tooling, runbooks, and external partnerships. Australian organisations increasingly engage managed detection and response providers to give round-the-clock coverage across time zones, since so many local teams are lean compared with their US or European counterparts. The point of the programme is to make these investments demonstrably effective rather than line items on a budget sheet.
The improvement backlog itself becomes a management artefact. Each finding gets an owner, a due date, and a verification step in the next exercise cycle. Over twelve months the pattern of findings tells a story — perhaps that legal review is consistently slow at the containment decision, or that the forensic retainer covers only two of the three sites the team actually operates. Trends like these are exactly what boards want to see and exactly what regulators expect under CPS 234 and the SOCI Act.
Embedding tabletops into continuous cyber resilience
Exercises do not live in isolation. They reach their full value when they are tied into threat intelligence, vulnerability management, and the broader risk register. A scenario informed by current intelligence on, say, the active exploitation of a specific firewall vulnerability is far more compelling to executives than a generic ransomware story, and it produces findings that feed directly into remediation priorities.
The same logic applies to third-party risk. A serious proportion of breaches originate with suppliers and managed service providers, yet relatively few exercises rehearse a scenario where the incident is happening inside a trusted partner's environment. Walking through what contractual notification actually requires, who pays for forensic investigation, and how to revoke access without breaking production services surfaces weaknesses that vendor questionnaires never reveal. In a market where many Australian firms lean on offshore development and outsourced IT, this is the kind of rehearsal that pays for itself the first time it is needed.
The case for tabletop exercises is ultimately a case for treating post-breach response as a practiced discipline rather than a written promise. The Medibank and Optus incidents did not expose a lack of policies at those organisations; they exposed a gap between policy and performance. A disciplined exercise programme, anchored in local regulatory expectations and grounded in realistic threat scenarios, closes that gap one quarter at a time.
The plan that survives the next serious incident will not be the one that read best on paper. It will be the one whose owners have already argued the hard questions out loud, agreed who decides what, and confirmed that the tools, partners, and reporting lines actually behave the way the binder claims they do. What to carry forward is straightforward: rehearse often, rehearse realistically, and treat every finding as a commitment rather than a note.