Yes. A tabletop works well in a dedicated chat channel plus a short video call, and the written record is a bonus. Use a private channel, a facilitator posting timed injects, an evaluator logging decisions, and ground rules that keep the exercise separate from real work.
Why chat can work better than a room
In a meeting room, a few voices dominate and notes are patchy. In chat, everyone can answer, answers are timestamped, and the transcript becomes evidence. It also matches how a real incident unfolds for a distributed team. The limits are slower back and forth and less body language, which you can offset with a voice call.
Setup
- Create a private channel named clearly as an exercise, for example one with the word exercise in its name.
- Pin the ground rules. Say that nothing here is real and that nobody should run real commands against production.
- Share a one page scenario with the fictional package name, systems in scope and a roster of roles.
- Assign roles. Facilitator, evaluator, participants. See who should join a dependency compromise tabletop.
- Open a voice or video bridge for discussion, and keep chat for decisions.
Run of show for 60 minutes
| Minutes | Activity |
|---|---|
| 0 to 5 | Rules, roles, scenario summary |
| 5 to 15 | Inject 1, first decisions in chat |
| 15 to 30 | Injects 2 and 3, pause for discussion on the call |
| 30 to 45 | Inject 4, communication drafts posted in the channel |
| 45 to 55 | Final inject, decisions about closing and follow-up |
| 55 to 60 | Hot wash: one thing that worked, one gap |
Ground rules that help
- Post decisions in a set format, for example "Decision: block version 4.2.2 at the mirror. Owner: platform. Time: now."
- Use threads for side topics. Keep the main channel to injects and decisions.
- Label simulated facts. Start fictional data with a tag so nobody confuses it with real data.
- Do not use the real incident channel. A real alert during the exercise needs a clean path.
- Time zone aware scheduling. Pick a window that works for most, and rotate who gets the awkward time.
Keeping a clean record
Export the transcript when you finish. Ask the evaluator to add a short summary with timestamps for the first inject, the first decision and the key decisions. Remove personal data before sharing outside the group, and store the record with your other exercise documents. CISA's exercise materials include an After Action Report template you can fill from the transcript.
What to watch for
Remote sessions fail when people multitask. Ask for cameras off or on based on your culture, but ask for attention. Call on quiet participants by name. If a decision stalls for more than a few minutes, the facilitator asks "who decides?" and records the answer.
When to prefer in person
Prefer a room for the first run with a new team, for a scenario involving sensitive legal questions, or when the group is small and co-located. Otherwise remote works fine.
Quick check
Is a chat transcript enough evidence of the exercise?
It is a good start. Add a short evaluator summary, the attendee list and the list of follow-up actions with owners.
How do we stop people running real commands?
State the rule in the pinned message, use fictional names, and have the facilitator remind the group when a step would normally need a command.
Safeguard can help with the inventory side of this work. SBOM and dependency scanning show where a package and version appear across your projects, and policies and gates can stop a flagged version at the pull request. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
