"Everybody has a plan until they get punched in the mouth." - Mike Tyson
Mike Tyson’s famous quote isn’t about boxing—it’s about the brutal collision between a well-manicured strategy and a chaotic reality. In business, the tabletop exercise is our chance to simulate that collision in a safe environment.
Yet, many leaders approach these exercises with a desire for reassurance. They want to see a smooth test where the plan is followed perfectly and the team handles the challenge with ease. But a test where everything goes right is a wasted opportunity. The real goal of a tabletop exercise is not to validate your plan, but to get "punched in the mouth"—to find your plan's breaking points so a real crisis doesn't find them for you.
Designing for Discovery: The Power of the Worst Case
To truly test a team, you can't throw softballs. A valuable tabletop exercise must be a stress test built around an extreme, but still plausible, worst-case scenario. This is a concept that elite military units and emergency services have understood for decades. They don't practice for the best-case scenario; they relentlessly train for the worst.
The logic is simple: if your team and your plan can effectively navigate a catastrophic scenario, they will be calm, collected, and thoroughly prepared for the far more likely, less severe incidents they will actually encounter.
Imagine the difference in preparedness:
- A team that practices for a single server failure might be overwhelmed by a ransomware attack that takes out a whole department.
- A team that has practiced for a ransomware attack that encrypts the entire company, including their backups, will handle that departmental incident with practiced, confident precision.
A "worst-case" scenario isn't about fantasizing about meteor strikes. It's about taking a realistic threat and amplifying its impact by layering complications. What if the ransomware attack happens during a key product launch? What if your primary communication channel is compromised at the same time your key supplier goes offline?
Designing these scenarios forces you to uncover hidden dependencies, resource gaps, and communication breakdowns that would only otherwise be discovered in the chaos of a real crisis.
There is No "Fail" in Tabletop
This brings us to the most important mindset shift for leaders: a tabletop exercise is not a pass/fail test.
The goal is not to get a perfect score. A tabletop where everything goes perfectly according to the plan is arguably a failed exercise. It means the scenario wasn't challenging enough or the participants weren't engaged enough to question the assumptions and stress the system.
A successful tabletop is one that ends with a long list of action items. It uncovers flaws in the plan, reveals a need for new resources, and exposes misunderstandings between departments. Every "failure" within the safe confines of the exercise is a critical vulnerability discovered and a priceless opportunity to strengthen your organization before it really matters.
When a team says, "We wouldn't be able to do that," or "We don't have a plan for this," the correct response is not disappointment. It's "Excellent. We've found something real. Let's dig in."
Conclusion: Stress-Test Your Strategy
Your plans for Business Continuity, Disaster Recovery, or Incident Response are built on assumptions. The only way to know if those assumptions are valid is to deliberately and methodically try to break them.
When you design your next tabletop exercise, resist the urge to create a scenario that will make your team look good. Do the opposite. Challenge them with a difficult, multi-faceted crisis that stretches their capabilities and pushes them beyond the comfortable boundaries of the written plan.
Don't just test if your team can follow a plan. Test their ability to survive when the plan falls apart. That is how you build a truly resilient organization.