136: Inside the Tabletop: What an Airport OT Incident Taught Us About Command, Cost, and Chaos

Um, and what I'd like to do is start it off, and it's slight audible, is frame up in general the whole purpose of incident, of doing tabletop exercises.

We have a lot of different people.

I saw, um, a lot of people that hadn't had zero experience with, uh, what we did at, at, at the level zero in 2026.

So one of the key things with a tabletop exercise, the whole goal is to practice how you fight.

That's that whole notion that essentially as an incident comes out, you wanna know how you would go about it, how would you attack it, how would you address it.

Now, tabletop exerc- exercises allow you to test your plans, which is one of the classic ones.

Most people know an incident response plan, and you're basically running a tabletop exercise to test that out.

You can have a tabletop exercise to go against the latest threat.

You may hear, "Oh, we heard about this, uh, salt typhoon or, and we wanna exercise to see how well we could combat that particular type of attack." Or you can have one, uh, tabletop that looks at your main vulnerabilities in your organization, and you can highlight and pull out a particular element that keeps happening in your or- organization, and it's a way to drill and test that out.

The ICS for ICS takes on a whole nother focus point, 'cause what it does is it focuses on the operational and command structure.

'Cause what happens in a major incident, we talk about most of our incidents that we in the OT world don't always just deal with, oh, we got infected and, you know, a system went down.

There's also a lot more complications, and it is a bigger thing.

It could lead to a operational interruption, to a actual safety, physical, life-threatening scenario.

And with the ICS for ICS process, get, it puts a whole structure around it to address a wide range of, of incidents that will have to involve a wide range of people.

So one of the key things that I, I sorta, I, I allow...

I wanted to drill in because I know Christian undersold himself a little earlier there, but what do you feel, and, and I'll put this first question to Christian, the importance of doing a, uh, tabletop exercise in general?

The, uh, thanks for that question.

Tabletops, they make all the difference in the world, right? Uh, if you can make that tabletop relevant and get the right folks in the room, it, uh, it changes what the dynamic is.

I remember the very first tabletop that I ever went to, and, uh, I was a substitute for a substitute for a substitute for a substitute in there, and it was meant to be a major emergency response team, uh, style event.

I went, thought it was fantastic, thought it was a great experience, but my senior leadership at that time, they never got that experience.

So when a real-world event happened, they didn't even know the correct room to go to at that point.

So I'm really getting down to the point of relevance there.

For us at, uh, at UPS, this year alone, we did over 300 tabletop exercises with our different, uh, district, uh, team members so that we had the correct folks and the correct level of engagement.

They don't need to go into how to clean up malware on their system, but they do need to be able to get the correct people engaged versus them trying to troubleshoot a problem by themselves when there's an entire team behind them.

Did that kinda-