Run a zero-day tabletop by presenting a fictional advisory, adding a new fact every ten minutes, and asking each role what it would do. In 60 minutes you learn who is missing, where the inventory fails, and which approvals stall. Capture gaps as dated actions before anyone leaves the room.
Set up
Pick a facilitator who is not the incident owner, so the owner can play their real role. Invite the same people who would respond: technical lead, system owners, communications, legal, an executive. Tell them it is about the process, not a test of individuals.
Write the scenario beforehand. Keep it fictional and avoid real product names so nobody argues about the real flaw.
Sample scenario
A widely used file transfer library, which the exercise calls "LibExample," has a remote code execution flaw. The vendor says exploitation has been seen. No fix exists. Your company uses it in some products and some internal tools.
Timed injects
| Minute | Inject | Prompt |
|---|---|---|
| 0 | Advisory published, no fix | Who is the incident owner? What do we do first? |
| 10 | Government catalog lists it as exploited | Does this change priority? |
| 20 | Support reports a customer asking if you are affected | What do we say? |
| 30 | Inventory shows 12 systems affected, 8 unknown | Who owns the unknowns? |
| 40 | A stopgap exists but breaks a feature | Who decides? |
| 50 | Logs show odd traffic on one host | Is this an incident? Who must be told? |
| 60 | Close | Capture actions |
Change the inject numbers to match your environment.
Discussion prompts
- Which of our inventory sources would we trust, and where would we look for the rest?
- Who can approve an emergency change at 2 a.m.?
- Do we know where personal data sits on the affected systems?
- What does legal need from us in the first hours? See breach notification after a zero-day.
Capture the output
Assign a note taker. Record gaps in three columns: gap, owner, due date. Limit the list to five. Review progress at the next regular security meeting.
Repeat
Run it twice a year with a different scenario each time: a library, an edge device, a SaaS vendor. The roles in who does what in a zero-day response make a good attendance list.
Tips for the facilitator
Let silence sit for a moment after each prompt, since people often have the answer but wait for permission. Do not rescue the group. If they stall, that stall is the finding. Keep the clock firm so you cover all injects.
Quick check
Do we need an outside facilitator?
No. Any neutral internal person can run it, provided they are not also the incident owner.
Should the scenario use a real vulnerability?
A fictional one avoids debates about real details and keeps attention on process.
Last reviewed: 19 October 2026.
