How SOC and IR Tabletop Exercises Expose Gaps Before AI-Enabled Attackers Do
In this blog
A tabletop exercise is one of the quickest ways to find out whether your security operations and incident response teams can keep pace with frontier AI threats, and where to invest if they can't.
Summary: Frontier artificial intelligence (AI), meaning the most capable models available today, lets attackers get from initial access to business impact faster than many incident response plans were built to handle. A security operations center (SOC) and incident response (IR) tabletop exercise gets the analysts, responders and engineers who do the hands-on work in one room and tests how they'd handle that kind of attack before a real one happens. What comes out of it is a specific list of capability, process, training and tooling gaps you can prioritize and fund.
Take a fairly typical overnight shift. At 2:40 a.m., an alert fires on a spike in failed logins against a cloud tenant, followed by a successful sign-in from a service account that nobody recognizes. The SOC analyst on shift is working the queue manually, clearing lower-priority alerts one at a time, and doesn't get to it for 12 minutes. Tracking down the account's owner means jumping by hand between the identity console, the cloud logs and an asset spreadsheet nobody has updated in months. That's another 14 minutes. The bridge call opens at 3:08 a.m. The incident lead joins at 3:15 a.m., 35 minutes after the first alert.
By then, the attacker has mapped the environment and started pulling data out in small batches that look like routine sync traffic. The team followed the plan to the letter. The plan just wasn't written for an attacker using frontier AI to automate every step.
That mismatch between the plan and the pace of the attack is exactly what a good tabletop exercise should surface.
Why Frontier AI Breaks Traditional Incident Response Timelines
For years, defenders could count on some lead time. Weaponizing a new vulnerability took real effort, and pulling off a multistage intrusion required a skilled team.
That lead time is shrinking fast. According to Defending at the Speed of AI, the median time from a vulnerability's publication to a working exploit fell from 23.2 days in 2025 to under one day in 2026.
For SOC and IR teams, frontier AI changes four things:
Speed. AI can now generate working exploits in minutes which once took exploit developers months.
Scale. Work that once took a specialized team can now be handed to a swarm of AI agents that operate without fatigue or shift changes.
Believability. Cloned voices and deepfake video make social engineering of help desks far more convincing.
New attack surface. The AI assistants and agents your teams use can be manipulated through the emails and documents they read, then act with the accesses provisioned to them.
If your organization's response plan and SOC workflows haven't been tested against these shifts by the people who execute it, you can't prove it will hold up against waves of AI-enabled attackers.
Four Frontier AI Threats a Tabletop Should Put in Front of Your Team
Standard ransomware scenarios rarely test the assumptions that frontier AI breaks. Each of these four scenarios puts a different part of SOC and IR readiness to the test, and how your team responds demonstrates whether it's ready.
1. The Machine Speed Intrusion
An AI-driven attacker gets in through an exposed edge device and moves from reconnaissance to staging data in under an hour, while a wave of low-quality alerts floods the queue.
What it reveals: Whether analysts can triage the flood of alerts and contain a threat before the investigation is finished, and whether anyone on shift can approve isolating a production system at 3 a.m.
2. The Deepfake Executive
A caller with a near-perfect clone of the chief financial officer's (CFO's) voice asks the help desk to reset multifactor authentication (MFA) on a "locked" account. Two hours later, finance gets a video call from the same "CFO" requesting an urgent wire transfer.
What it reveals: Whether the help desk can verify a caller when a voice can be faked, how quickly fraud signals reach the SOC and whether an analyst can connect the MFA reset to the wire request.
3. The Same Day Exploit
A critical vulnerability is published in an internet-facing application you run. A working exploit appears within hours, and threat intelligence shows active scanning against your industry.
What it reveals: Whether vulnerability management and SOC analysts can confirm exposure and hunt for signs of exploitation within hours, and who has authority to choose between emergency patching and temporary protective controls.
4. Your Own AI Turned Against You
An internal AI assistant with access to email and file shares processes a document containing hidden instructions. It starts forwarding sensitive files to an outside address and creates mailbox rules to hide its activity.
What it reveals: Whether SOC analysts can see AI agent activity at all, and how quickly responders can revoke agent credentials and remove the hidden mailbox rules.
How a Tabletop Demonstrates SOC and IR Readiness for Frontier AI Threats
Running those scenarios with the SOC analysts, incident responders, engineers and help desk staff who work your incidents turns readiness from an assumption into evidence. Instead of asking whether the playbook covers frontier AI threats, a tabletop shows whether your SOC and IR teams can detect, decide and contain at the speed those threats demand.
The National Institute of Standards and Technology (NIST) has long backed this approach. Its guidance on exercise programs, NIST Special Publication (SP) 800-84, describes exercises as a way to identify deficiencies in plans, procedures and training. NIST's updated incident response guidance, NIST SP 800-61 Rev. 3, treats incident response as part of cybersecurity risk management across all six functions of the NIST Cybersecurity Framework (CSF) 2.0. Readiness is a business issue, but it starts with the teams who respond.
WWT's own Defending at the Speed of AI program recommends a tabletop built around an AI-driven breach, with legal, communications and executive leadership in the room alongside the SOC. Having SOC and IR teams in that room matters, because leaders can only decide as fast as the SOC can see and confirm what's happening.
Against a frontier AI scenario, a tabletop demonstrates four elements of readiness that playbook reviews and audits can't:
It's also the lowest-risk way to test readiness. A few hours with your analysts and responders in a conference room costs far less than finding the same gaps during a live incident.
How Tabletop Findings Expose Capability, Process, Training and Tooling Gaps
A tabletop produces findings in four categories. The people in the room handle incidents every day, so the findings are specific. Sorting them this way keeps the results actionable and makes clear who owns each fix.
Capability Gaps
Things the team needs to do but can't:
No logs from AI assistants or agent frameworks.
Detections mapped to traditional attacker techniques, but none for the AI-specific attacks cataloged in MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems).
No quick way to line up identity, endpoint, network and cloud activity in one timeline.
No reliable asset inventory, so nobody can answer "are we affected?" in minutes.
As WWT's post on the observability gap facing security teams explains, defenders can't protect systems they can't see.
Process Gaps
Things the team could do, but the process slows or blocks:
Containment that needs approval from people who can't be reached quickly.
Playbooks with no coverage for deepfake fraud or AI agent compromise.
Unclear ownership when an incident spans security, information technology (IT), fraud and the AI or data team.
Severity definitions that weigh impact but ignore speed.
Communication plans that depend on email or chat platforms the attacker may control.
Training Gaps
Things the process covers, but people aren't ready to do:
Analysts who have never investigated prompt injection, where hidden instructions hijack an AI tool.
Help desk staff without a clear script for verifying callers when a voice can be faked.
Responders unsure of their decision rights or when to escalate so leaders can meet regulatory notification deadlines.
Analysts relying too heavily on AI-generated summaries and recommendations.
Tooling Gaps and Investment Priorities
Instead of building a budget request on industry benchmarks, a tabletop lets you build it around specific moments when your analysts and responders couldn't see or act fast enough.
Hearing from the people who run the tools also separates "we need a new tool" from "we need to use the tool we already have." Some gaps turn out to be configuration or integration problems, not missing products.
Common tabletop moments and the investment signals they point to
| What you might hear in the room | What it reveals | Where to invest |
|---|---|---|
| "We'd need a vice president to approve isolating that server." | Containment authority is too slow | Preapproved containment playbooks and response automation |
| "We don't log what our AI assistant does with mailbox access." | No visibility into AI agent activity | Agent logging and governance for nonhuman accounts |
| "The help desk would probably reset it if the caller knew the details." | Weak identity verification | Caller verification steps and phishing-resistant MFA |
| "We'd find out what's exposed when the next scan runs." | No continuous view of exposure | Exposure management and faster remediation workflows |
| "Our endpoint tool can isolate hosts, but we've never turned that on." | Existing capability left unused | Configuration and tuning before new spend |
Weighed against business impact and the effort to fix them, these findings become a prioritized roadmap you can defend in front of finance and the board.
What Organizations Gain From Regular Tabletop Exercises
AI hasn't changed the basics of incident response. You still need to detect, decide, contain and recover. What AI has changed is how much time you get for each step, and a tabletop shows you where that time goes.
For SOC and IR leaders, running tabletops on a regular cadence turns that insight into readiness you can demonstrate over time:
Measurable progress. Scoring each area on a consistent maturity scale shows leadership how readiness changes from one exercise to the next.
Decisions made in advance. Analysts and responders who have already worked through decision rights don't have to negotiate them during a live incident.
A path to hands-on validation. Tabletops test decisions and coordination. Purple team exercises and cyber range training then confirm whether controls and people perform the way the room said they would.
Targeted skill building. Training gaps become specific learning plans for analysts, responders and help desk staff.
Frequently Asked Questions About SOC and IR Tabletop Exercises
How does a tabletop demonstrate readiness for frontier AI threats?
It puts the SOC analysts, incident responders, engineers and help desk staff who work your incidents in front of a realistic frontier AI scenario and shows whether they can detect, decide and contain at machine speed. Where they can't, the findings show exactly where readiness breaks down.
Why do SOC and IR teams need tabletop exercises if they already have playbooks?
A playbook describes what should happen. A tabletop shows whether analysts and responders can follow it at the speed a frontier AI attack demands and where the plan's assumptions no longer hold.
Why focus a tabletop on frontier AI threats?
Frontier AI changes how fast attacks move and adds your own AI tools to the attack surface. A scenario built around those shifts tests assumptions a traditional exercise leaves untouched.
How does a tabletop fit with red team and purple team testing?
A tabletop demonstrates whether decisions, authority and coordination hold up against a frontier AI scenario. Red team and purple team exercises then test whether technical controls and detections hold up against an authorized attack. Start with a tabletop to find operational decision and process gaps, then use technical exercises to confirm the fixes work.
What does an organization get from a tabletop exercise?
A prioritized set of capability, process, training and tooling gaps tied to specific moments in the exercise, evidence of where your SOC and IR teams already perform well and a clearer case for where to invest.
How WWT Can Help With SOC and IR Tabletop Exercises
WWT designs and facilitates SOC and IR tabletop exercises tailored to your environment and the frontier AI threats you face. Through our Security Tabletop Exercises Workshop, we build scenarios from actual security data and deliver a report that names your strengths and weaknesses and recommends next steps.
We can then help you refine playbooks and map tooling gaps to a prioritized roadmap. Before you commit budget, compare candidate solutions side by side in our Advanced Technology Center (ATC) and AI Proving Ground. For more, explore our security operations and AI security insights.
Ready to see how your analysts and responders hold up against frontier AI threats? Contact WWT to schedule a SOC and IR tabletop exercise.