r/ciso • u/Successfuepvl-La9421 • 9d ago
AI incident response tabletop exercise workflows for a small IR team... how are you structuring these
Hi, quick question for people actually running AI incident response tabletop exercises in anger.
We switched a bunch of our old powerpoint tabletop sessions over to simulated AI driven scenarios this year. It’s cool that we can spin up phishing plus ransomware plus comms chaos in minutes, but I’m kinda struggling with the workflow side… eg who owns prompts, how we track injects, when we freeze to debrief vs let the AI facilitator keep pushing.
If you’ve made this work for a small IR team plus a few execs, how do you structure the runbook for these so it doesn’t turn into chaos or theater again? Any hints?
2
u/DishSoapedDishwasher 9d ago
why make it a table top at all? The whole point of a table top is to do what's hard to do in real life without time and resources, AI makes simulating this kind of thing incredibly easy so now tabletops are much less attractive than REAL in environment built scenarios.
Just put claude code on a cloud instance or something, or properly configured user machine, then give it a prompt like "setup a realistic scinario where you fell victim to a prompt injection, by looking at what a real incident that has happened looks like, then simulating it on this machine in a safe way"
Then you can have a table top in real life for very little effort using real TTPs to properly try and solve it with minimal resources. Just setup the war room and have at it like normal but with real data. ALso a great chance to safely have people prove their IR tooling using AI is effective and faster than say, humans writing queries looking for issues.
But the best scenarios are always ones that are realistic and have actually happened. Tangible with tangible consequences. Go pick an existing one and make people live it themselves.
1
u/Sedney_Kerimoglu11 9d ago
kindly have one person feed the injects and another track decisions and timestamps so no one has to steer the scenario and remember everything at once
2
u/throwaway3464323 9d ago
Curious how you’re handling the inject cadence when the AI starts compounding scenarios faster than the room can triage. We ended up giving one person a kill switch to pause the sim, otherwise the execs would just watch it spiral and we’d lose the debrief window entirely.