Yes. A mini tabletop uses one inject, four questions and 20 minutes, which fits the end of a sprint retro or team meeting. It will not replace a full exercise, but it keeps the habit alive and surfaces small gaps cheaply.
The format
| Minutes | Step |
|---|---|
| 0 to 2 | Read the inject aloud |
| 2 to 14 | Answer four questions, round robin |
| 14 to 18 | Scribe lists gaps and unknowns |
| 18 to 20 | Pick one action with an owner and a date |
One person facilitates and another scribes. Rotate both each time.
The four questions
- Find: how would we learn whether this affects us, and who does that?
- Contain: what is the first thing we would turn off or revoke, and who can?
- Tell: who needs to know, and who says what?
- Prove: how would we show that we are clean afterwards?
Insist that answers name a tool, a command or a person. "We would look" is not an answer.
Five one-inject prompts
- A maintainer of a library we use posts that their account was taken over last week.
- A CI action we use has a new release published at 3 a.m. with no changelog.
- The registry sends an email saying a token of ours was seen in a public repository.
- A new engineer installs a package an assistant suggested and nobody has heard of it.
- A container base image we use has a note saying a tag was repointed.
Each maps to a threat on the SLSA list, such as use of a compromised dependency or package, which you can read about in the scenario selection guide.
What to do with the output
Keep a running log with the date, the inject, the gaps and the action. After four or five minis, you will see patterns. Common ones:
- Nobody knows where lockfiles for older services live.
- Only one person can revoke registry credentials.
- No one owns customer communication for technical incidents.
Escalate patterns to a full tabletop or a functional drill, and write actions into your tracker. The metrics guide helps you compare minis over time.
When a mini is not enough
Move to a full session when you need to test multiple roles, escalation to leadership, or real tools under time pressure. A mini cannot do that in 20 minutes.
Try it yourself
Click through it at your own pace, or open it full screen. Pick one alert from it and use it as your inject for the next retro.
Safeguard offers zero-day discovery, SBOM scanning and a free scan, which supply realistic material for short drills.
Quick check
Is a mini tabletop worth the time?
Yes, for the habit and the small gaps it finds, as long as every session ends with one owned action.
How often can we run a mini?
Every sprint or every month is realistic. Rotate the facilitator so it does not become one person's chore.
Last reviewed: 19 October 2026.
