Auto tabletop tool case study for ot tabletop exercises
Leveraging our Partner ThreatGEN’s Auto Tabletop Tool to Deliver Real Insights and Simulate Outcomes Tied to Real-Time Actions for OT focused Tabletop Exercises
In OT cybersecurity tabletop exercises, success goes beyond static planning. Traditional TTX formats often rely on scripts and improvisation. We set out to test whether ThreatGEN’s AI based AutoTableTop™ tool could act as a dynamic co-facilitator to boost engagement, realism, and adaptability.
Introduction
In a recent OT-focused tabletop, we created a detailed scenario using a traditional approach—injects, roles, network topology, and team structures. AutoTableTop™ was layered in to deliver dynamic injects, pivot scenarios, and respond in real time to player decisions, enhancing immersion.
A key part of our setup was a maturity assessment aligned to NIST CSF and IEC 62443. It gave us a clear baseline of readiness and helped shape the scenario around actual capability gaps, driving realistic roles, inject timing, and expected responses. Rather than using the platform as a standalone simulator, we integrated it into the live session and preloaded it with:
- Network diagrams and team structures
- Key injects and event timelines
- Defined roles and escalation paths
- Maturity assessment findings for context
Summary
Throughout the exercise, AutoTableTop™ adapted to decisions, simulating threats, unexpected shifts, and evolving conditions that would be hard to replicate manually.
As a supplemental facilitator, AutoTableTop™ boosts realism, responsiveness, and complexity by integrating scenario design, network context, and maturity-based gaps into a live, interactive experience.
We took a hybrid approach: human-led facilitation supported by AutoTableTop™ for inject timing, scenario updates, and system behaviors. Our goals were to:
- Enhance realism and decision-making
- Reduce live facilitator workload
- Simulate outcomes tied to real-time actions
- Validate the use of maturity assessments as a scenario foundation
With the platform preloaded, AutoTableTop™ delivered alternate attack paths, evolving challenges, and reactive scenarios that aligned with the organization’s real gaps and readiness levels.
Results
AutoTableTop™ proved to be a powerful real-time enhancement to live tabletop exercises. It acted as a responsive co-facilitator, adapting injects and adversary behavior as participants made decisions. This created a more immersive, realistic, and impactful experience.
A standout feature was its ability to address participants by name and role—e.g., “SOC Analyst John receives an alert”—which increased engagement and accountability.
The maturity assessment was crucial in shaping the experience, helping align simulation challenges to actual organizational weaknesses.
Key benefits observed:
- Reduced manual workload for facilitators
- Smoother pacing and adaptive escalation
- Greater immersion through personalized interactions
- More realistic pressure through unplanned AI-driven responses
- Strong alignment between maturity gaps and learning outcomes
Ultimately, AutoTableTop™ enhances custom tabletop exercises with deeper realism and agility—without adding to facilitator overhead.