Methodology IT: we make IT work Skills / Tabletop in a Box Visit methodologyit.tech →

Run your first cyber incident drill this month. No consultant, no slides.

Tabletop in a Box is a free kit that runs a 45-minute tabletop exercise with your leadership team. Claude plays the facilitator: it reads the scenario, drops in the surprises, asks who does what, and writes up the gaps at the end. Your insurer and your auditor both want the date of your last one.

Get the kit free45 minutes · 3 to 8 people · works in Claude, instructions for ChatGPT and Gemini

How a session runs

0:00
Pick the scenario
Ransomware on a Monday, the admin account taken over, or the wire request that sounded like the boss. The kit asks eight questions about your company first so the scenario uses your systems and your job titles.
0:05
Play it through
The facilitator reads the first inject and asks the room: who finds out, who do they call, what do you do in the first hour. Every 8 to 10 minutes something new lands.
0:40
Get the report
A one-page after-action report: what went well, the gaps found, who owns each fix, and the dated record insurers and auditors ask for.
Minute 18, inject 3Sample

It's 9:40 AM. Your controller calls: QuickBooks won't open, and there's a text file on the desktop that says your files are encrypted. Two other people have the same screen. Your IT provider's phone is going to voicemail.

Facilitator: Who is in charge right now? Not who should be. Who, by name, in this room, and what's the first thing they do?

Follow-ups the kit asks if the room goes quiet: Do you shut the network down, and who is allowed to make that call? Where is the cyber insurance policy number? Who tells the staff what to do with their laptops in the next ten minutes?

After-action report, excerpt5 gaps
Nobody could name the incident lead.
Two people assumed it was each other. Decide now, write it in the plan.
Owner: CEO
The insurance hotline number lives in one person's email.
Print the policy number and the breach hotline; keep a copy off the network.
Owner: Controller
No one knew whether the backups were separate from the network.
Ask your IT provider this week, in writing.
Owner: Ops manager
Staff would have kept working on infected machines.
A one-line rule: unplug, don't power off, wait for the call.
Owner: Office manager
The IT provider's after-hours number wasn't in the room.
Add it to the printed sheet with the insurance number.
Owner: CEO

Why a tabletop, and why now

A tabletop is an hour where the leadership team talks through a bad day before it happens. It costs nothing, and it finds the gaps that only show up under pressure: who's in charge, who calls the insurer, whether anyone knows where the backups are.

Cyber insurance renewals now ask for the date of your last one. So do SOC 2 and HIPAA reviews. Most small businesses have never run one, because it sounded like something you hire a consultant for.

What's in the box

A skill file for Claude (instructions for ChatGPT and Gemini included) that runs the session, three scenarios written for businesses your size, a facilitator's one-page guide, and the after-action report template. It takes your company's details first, so the scenario names your systems and your roles, not generic ones.

Who should be in the room

The owner or CEO, whoever runs operations, whoever handles money, and whoever staff would call first. Three to eight people. Your IT provider is welcome but it works without them, and some of the most useful gaps appear when they're not there to answer.

What you get at the end

A one-page after-action report: scenario, what went well, the gaps, an owner for each fix, and the date. Keep it with your insurance file. Run it again in six months and compare.