When the group says "we do not know", write the gap down, ask what they would do next to find out, and keep the scenario moving. A gap is a finding, not a failure of the exercise. The facilitator's job is to make the unknown visible, timestamped and owned, without stalling the session.
Why "we do not know" is valuable
Most tabletop value comes from discovering what you cannot answer. If the group never says "we do not know", the scenario was too easy or people are bluffing. The skill lies in handling the moment.
Five moves
1. Name it. Say it aloud: "That is a gap: we cannot say which services use the package." Writing it on a shared board or in the channel turns an awkward silence into a visible item.
2. Ask for the workaround. Real incidents force improvisation. Ask "If this were real, what would you do in the next ten minutes to find out?" The answer shows resourcefulness and reveals which people know the system.
3. Time box it. Give the group three minutes to talk through the workaround, then continue. If the unknown blocks the next inject, state an assumption: "For the exercise, assume you found it in four services."
4. Assign an owner. Before moving on, name who would own closing the gap and by when. A name in the log beats a vague "we should look into that."
5. Revisit at the end. In the hot wash, read out the gaps and ask the group to rank them by how much time they cost.
Phrases that help
| Situation | Facilitator line |
|---|---|
| Silence | "What would you try first if the clock were running?" |
| Group guesses | "How would you confirm that? Where would you look?" |
| Two people disagree | "Who has authority to decide? Let us log that decision." |
| Someone says "I would ask Sam" | "Sam is on leave. Who else could answer?" |
| Debate drifts | "Let us park this as a gap and keep going." |
What to avoid
- Solving it for them. If the facilitator supplies the answer, the group learns nothing about their own readiness.
- Blaming anyone. Keep wording about the system: "no one can currently search all repos."
- Letting a gap swallow the hour. One missing capability can consume the whole session. Assume and move on.
- Skipping the log. Gaps lost in conversation come back unchanged next time.
Record gaps in a useful format
| Gap | What we could not answer | Time cost in exercise | Proposed owner |
|---|---|---|---|
| Inventory | Which services use the package | Eight minutes | Platform lead |
| Contacts | Who approves external statements | Five minutes | Security lead |
Feed the table into your after action report. CISA's exercise templates include an After Action Report format you can use for this. Then sort the gaps with tool, process, knowledge and ownership categories.
Quick check
Should the facilitator provide the missing information?
To keep the scenario moving, and label it as an assumption. Do not solve the gap in a way that hides it.
What if the group has too many unknowns to continue?
Pause, agree that readiness is the finding, and switch to a working session on the biggest gap. Rerun the scenario later.
Safeguard can help with the inventory side of this work. SBOM and dependency scanning show where a package and version appear across your projects, and policies and gates can stop a flagged version at the pull request. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
