How do you run a security tabletop with a remote team?

Run a remote tabletop with a video call, a shared document as the scribe board, a separate channel for facilitator notes, and strict turn taking. Keep the session to 60 minutes, use a time zone overlap that suits the responders, and rehearse the tooling first.

What changes when everyone is remote

In a room, people read each other's faces and a whiteboard holds the state. Remotely, silence is ambiguous and the state is invisible unless you build it. The fixes are simple and mostly about structure.

Setup checklist

• Video call with a fixed link and a backup, in case the tool fails.
• Shared scribe document everyone can see, with sections for timeline, decisions, open questions and corrective actions.
• Inject delivery by pasting text into the document at the stated time, so the whole team sees the same words.
• Facilitator back channel for the facilitator, evaluator and scribe only.
• Out of band channel for the exercise's communications inject. If your scenario assumes chat is compromised, practise switching to another route. Keep this a pretend step, since a drill should not disrupt real work.

Running the session

1. Spend five minutes confirming the rules and who plays which role. See roles explained.
2. Read each inject aloud and paste it into the document.
3. Ask for answers by role, not by volunteering. "CI owner, what would you search first?" avoids the long silence.
4. Have the scribe read back each decision so errors are caught live.
5. Close with a two minute round where everyone gives one change they will make.

Time zones

Pick a window where the people who would actually respond are awake. If that is impossible, run two shorter sessions on the same scenario and merge the findings. Avoid making the same people join at their night time every quarter. Note that a real incident will have the same problem, so the finding "nobody on the overnight shift can revoke registry tokens" may be one worth recording.

Keep everyone engaged

• Turn cameras on if the team is comfortable, but do not require them.
• Cap each discussion at five minutes.
• Use a poll or a quick reaction for yes or no decisions.
• Ask quiet people directly and give them a moment. Do not rush to fill silence.
• Keep observers muted and ask them to write comments in a separate section.

Pitfalls

After the session, write up findings in an after-action report within a week while memory is fresh. For distinct scenarios to run, see the GitHub Action script.

Try it yourself

Click through it at your own pace, or open it full screen. Notice how one shared view of findings and owners removes a lot of status chasing, which is the same thing a shared scribe board does in a drill.

Safeguard offers policies and compliance evidence automation, so exercise records can sit with other control evidence. You can also try a free scan.

Quick check

Last reviewed: 19 October 2026.