Tabletops & Dragons

Tabletops & Dragons

Speakers: Colby Prior, Security Engineer, Octopus Deploy

Conference: CrikeyCon

YouTube: https://www.youtube.com/watch?v=HAwW91tJd0U

Overview

Colby Prior's CrikeyCon talk, "Tabletops & Dragons," presents a compelling argument for revolutionizing tabletop exercises in cybersecurity. Prior, a security engineer at Octopus Deploy, draws a creative parallel between the dynamic, collaborative storytelling of Tabletop Role-Playing Games (TTRPGs) like Dungeons and Dragons and the often-stagnant practice of incident response simulations. He asserts that the prevalent perception of tabletop exercises as tedious, compliance-driven obligations is a self-inflicted wound, and that by embracing principles of engaging scenario design and dynamic facilitation, these exercises can become genuinely effective and enjoyable.

The central thesis of Prior's presentation is that the flexibility inherent in most compliance requirements for tabletop exercises offers ample opportunity for innovation. Rather than defaulting to predictable, linear simulations, organizations can inject elements of sophisticated threat actor motivation, foster genuine player agency, and employ reactive facilitation techniques to mirror the chaotic and unpredictable nature of real-world security incidents. This shift aims to transform rote compliance activities into vital learning experiences that not only sharpen technical response capabilities but also strengthen cross-functional communication and overall security culture.

Prior's methodology is designed to empower security practitioners to move beyond a "checkbox mentality," encouraging them to craft immersive narratives that challenge assumptions and reveal unforeseen vulnerabilities. By adopting a "Dungeon Master" mindset, facilitators can guide participants through complex, emergent scenarios, allowing teams to practice critical thinking and collaborative problem-solving in a psychologically safe environment. The ultimate goal is to enhance an organization's preparedness for actual breaches, ensuring that procedural and technical gaps are identified and addressed proactively, rather than under the duress of a live attack.

Background

▶ Watch: Making tabletop exercises fun like D&D (0:00)

The impetus for "Tabletops & Dragons" stems from a widespread frustration within the cybersecurity industry: the routine reduction of tabletop exercises to a mere compliance formality. As Colby Prior observes, many organizations conduct these simulations primarily to satisfy regulatory mandates, leading to a mechanistic approach that often prioritizes documentation over genuine learning. Prior challenges the notion that compliance itself is the culprit, arguing that the broad, "loosey goosey" nature of most security frameworks (e.g., "sit around a table [and] talk about what happens if an incident was to occur") actually provides significant latitude for creative implementation.

Despite this flexibility, security teams frequently fall into a pattern of predictable, uninspired scenarios that fail to capture the complexity and dynamism of real-world threats. This results in exercises that are disengaging, boring, and ultimately ineffective at truly testing an organization's incident response capabilities. Prior contrasts this with the inherent excitement and problem-solving nature of actual security work, and the creativity of sophisticated attackers, questioning why these simulations are allowed to become so monotonous.

The talk directly links this problem to the principles found in Dungeons and Dragons (D&D) and other Tabletop Role-Playing Games (TTRPGs). Prior, whose extensive D&D background informs his perspective, highlights that TTRPGs are fundamentally designed for engagement, collaborative storytelling, and emergent gameplay. He argues that the techniques used by a Dungeon Master (DM) to craft immersive narratives, manage player actions, and adapt to unforeseen circumstances can be directly applied to cybersecurity tabletop exercises. The problem, as Prior frames it, is not the concept of the exercise itself, but how security professionals choose to execute it, often failing to harness the intrinsic "fun" of theory-crafting and problem-solving in a simulated crisis.

Key Findings

▶ Watch: Designing engaging scenarios with sophisticated threat actors (4:00)

Colby Prior's presentation delivers several key findings that advocate for a transformative approach to cybersecurity tabletop exercises:

1. Compliance is Not the Constraint: Prior firmly debunks the common belief that compliance requirements inherently make tabletop exercises boring. He argues that regulatory standards are often high-level and flexible, leaving ample room for engaging and innovative design. The blame, he suggests, lies with security practitioners who fail to capitalize on this freedom.
2. TTRPG Principles Enhance Effectiveness and Engagement: The core insight is that principles from Tabletop Role-Playing Games (TTRPGs) significantly boost both the engagement and educational value of security tabletop exercises. These include sophisticated scenario design, fostering player agency, dynamic incident response facilitation, and embracing nonlinear storytelling.
3. Sophisticated Threat Actors are Essential: Generic "DOS for DOS gods" scenarios are insufficient. Prior emphasizes the need to design threat actors with complex motivations, diverse toolsets (e.g., insider threats, multi-stage attacks), and robust contingency plans. This realism forces participants to think strategically about adversary capabilities beyond immediate technical indicators.
4. Embrace Player Agency and Attacker Adaptability: Effective exercises must account for participants' attempts to "jump the gun" or find unconventional solutions. Crucially, the simulated attacker must also be dynamic, adapting to the defenders' actions with multiple fallback plans, mirroring real-world adversary behavior. This prevents a linear, predictable exercise.
5. Visual and Narrative Documentation is Superior: Prior advocates for moving beyond rigid PowerPoint presenter notes, which rely on a linear sequence of injects. Instead, he recommends a more visual, non-linear documentation approach, similar to a Dungeon Master's campaign map, that outlines attacker motivations, tools, and contingency plans. This allows facilitators to dynamically adapt to unexpected player decisions.
6. Realistic Player Handouts Drive Immersion: Rather than clinical alerts, using authentic-looking player handouts like screenshots of mock Slack conversations, angry customer emails, or simulated compromised logs immerses participants more effectively. This forces teams to interpret ambiguous information, reflecting the chaos and uncertainty of a real incident.
7. "Lead with Principles, Follow with Rules" for Facilitation: During an exercise, the priority should be maintaining narrative flow and collaborative problem-solving. Minute procedural details or debates over control efficacy should be captured as action items for post-exercise follow-up, preventing the session from getting derailed.
8. Psychological Safety is Paramount: Creating a safe environment where participants are encouraged to "get stuff wrong" without fear of judgment is critical. This fosters open communication, allows for exploration of risky ideas, and is essential for identifying genuine gaps in an organization's incident response capabilities before a real incident occurs.
9. Nonlinear, Collaborative Storytelling Unlocks Insights: The most impactful exercises are not pre-scripted attack chains but emergent narratives shaped by the participants' decisions. This approach often leads to the discovery of "unknown unknowns," such as undocumented legacy systems with backdoor access, leveraging the collective knowledge of subject matter experts (SMEs) across the organization.

These findings collectively call for a paradigm shift in how organizations approach security tabletops, transforming them from mundane obligations into vital, dynamic, and educational experiences that significantly enhance organizational resilience.

Technical Deep Dive

▶ Watch: Lead with principles, not rules; embrace safe failure (12:00)

Colby Prior's methodology for designing and facilitating engaging tabletop exercises is rooted in two core technical pillars: sophisticated scenario design and dynamic at-the-table facilitation, both heavily influenced by Tabletop Role-Playing Games (TTRPGs).

Sophisticated Scenario Design:

Prior emphasizes moving beyond simplistic threat actors. Instead, he advocates for adversaries with complex motivations and diverse toolsets. An attacker might not just aim for a "DOS for the DOS gods," but could target a specific customer, use the organization as a stepping stone in a larger campaign, or leverage insider threats cultivated over an extended period. This depth encourages participants to consider strategic implications beyond immediate technical responses, for instance, recognizing a DDoS attack as a potential distraction for a more subtle data exfiltration operation.

A critical design element is anticipating player agency and attacker contingencies. Participants, aware they are in an exercise, might "jump the gun" or attempt unconventional solutions, such as immediately isolating a device via EDR or bypassing expected security layers. The scenario must account for these deviations, ensuring the simulated attacker possesses fallback plans. If one avenue is blocked, what is their next move? This multi-layered approach makes the simulation more resilient and forces deeper critical thinking.

The talk stresses the importance of mapping out pre-incident events. An attacker rarely "kicks down the front door" without prior reconnaissance or planning. Understanding the narrative leading up to the initial alert—Prior uses the analogy of a "vampire in love with a witch" to illustrate a personal, pre-existing motivation—provides crucial context for the attacker's objectives. This also extends to considering the impact on Non-Player Characters (NPCs), such as the help desk. If a DOS attack is overwhelming systems, the help desk, acting as "NPCs," will be frustrated and overwhelmed, impacting their ability to respond rationally, adding emotional realism to the simulation.

Crucially, Prior advocates for a radical shift in documentation. Traditional linear PowerPoint presenter notes, with their sequential injects, are deemed inadequate because they break when players deviate from the expected script. He proposes a more visual, non-linear approach, akin to a Dungeon Master's campaign map. This map would visually represent the attacker's motivations, known tools, and a web of contingency plans, allowing the facilitator to dynamically adapt to player decisions and explore alternative attack paths. Furthermore, realistic player handouts, such as screenshots of mock Slack conversations, angry customer emails, or simulated compromised websites/logs, immerse participants more effectively than sterile alerts, forcing them to interpret ambiguous information as they would in a real incident (e.g., "My computer's running slow today" instead of "CrowdStrike came up with a popup").

At-the-Table Facilitation:

The second pillar focuses on the dynamic management of the exercise itself. Prior's principle of "lead with principles and follow with rules" is paramount. The goal is to maintain flow and engagement, preventing the exercise from getting bogged down in granular debates over technical specifics, such as the precise efficacy of an EDR control or DNS traffic blocking. Such questions should be captured as action items for post-exercise investigation, ensuring the exercise continues uninterrupted.

Psychological safety is a foundational element. Participants must feel comfortable "getting stuff wrong" in a safe environment, as this is where true learning occurs. Prior highlights that many security professionals face their first real incident experience "when everything's on fire." Tabletop exercises offer a vital opportunity to practice without real-world consequences, encouraging experimentation and open discussion.

The facilitator (or "Dungeon Master") has a responsibility to share the spotlight and manage participation, encouraging quiet team members to speak while gently redirecting prolonged technical deep dives that derail the narrative. It also means enforcing realism regarding personnel availability – an "on-call" person should be simulated as such, not as an immediately available resource if they would realistically be asleep.

Prior strongly differentiates between tabletop exercises and functional exercises, referencing the NIST TT& program. A tabletop is a discussion-based exercise, not a hands-on technical drill. Participants should not be logging into systems to test controls or restore databases; such actions constitute a functional exercise and disrupt the flow of a tabletop. The purpose of a tabletop is to "document possibilities, but don't explore them" in real-time. If a team is stuck, the facilitator should offer a "primer" or nudge.

Finally, Prior advocates for nonlinear and collaborative storytelling. The facilitator is not merely reading a script but co-creating the narrative with the participants. This emergent storytelling allows for the discovery of "unknown unknowns," such as undocumented legacy systems with backdoor access into production environments, which subject matter experts (SMEs) on the team might inadvertently reveal. While embracing spontaneity, time management is crucial. The facilitator must know when to "stop it there" if a rabbit hole is too deep, document it as a future investigation avenue, and redirect back to the core scenario to ensure the exercise concludes within its scheduled time.

Demo / Proof of Concept

▶ Watch: Tabletop vs. functional exercises: know the difference (17:00)

Colby Prior's "Tabletops & Dragons" talk does not feature a traditional technical demonstration of a specific security tool or exploit. Instead, the presentation itself serves as a conceptual "proof of concept" for how to conduct more engaging and effective tabletop exercises. Prior's "demo" is the detailed articulation of his methodology, illustrating through D&D analogies and practical advice how these principles can transform mundane security simulations. He uses rhetorical devices, such as adopting a "wizard robe and hacker wizard hoodie of plus one opinions," and provides concrete examples of scenario design and facilitation techniques rather than a live system demonstration. The core "proof" is the argument that a shift in mindset and approach can transform a compliance burden into a valuable and collaborative learning experience.

Defensive Implications

▶ Watch: Make tabletops fun to improve security culture (25:00)

The defensive implications of Colby Prior's "Tabletops & Dragons" talk are significant, providing a roadmap for security teams to enhance their incident response preparedness and foster a more robust security culture.

1. Elevate Tabletop Scenario Design: Defenders should move beyond generic, compliance-driven scenarios. Instead, invest in crafting sophisticated narratives featuring threat actors with complex motivations, diverse attack vectors, and multiple contingency plans. This includes considering insider threats, multi-stage attacks, and the psychological impact on Non-Player Characters (NPCs) like help desk staff. By anticipating how attackers adapt and how internal teams react under pressure, organizations can identify more realistic vulnerabilities.
2. Foster Player Agency and Adaptability: Design exercises that allow participants to make unexpected choices and "jump the gun." The facilitator must be prepared to adapt the scenario dynamically, reflecting how real attackers would respond to defensive actions. This requires moving away from rigid, linear scripts and embracing a more fluid, nonlinear storytelling approach.
3. Improve Documentation and Visualization: Abandon linear PowerPoint notes for a more visual, interconnected "campaign map" of the incident. This map should detail attacker motivations, tools, and all possible injects and their branching consequences. Utilize realistic player handouts (e.g., mock Slack messages, emails, screenshots of compromised systems) to simulate ambiguous real-world information, enhancing immersion and critical thinking.
4. Prioritize Psychological Safety: Create an environment where team members feel safe to make mistakes, ask "dumb" questions, and explore unconventional solutions without fear of judgment. This psychological safety is crucial for uncovering hidden vulnerabilities, fostering open communication, and allowing junior staff to gain invaluable experience in a low-stakes setting.
5. Distinguish Tabletop from Functional Exercises: Understand and respect the distinction between a tabletop exercise (discussion-based) and a functional exercise (hands-on technical testing), as defined by the NIST TT& program. Tabletop exercises are for discussing possibilities and identifying gaps, not for live system interaction. Capture technical questions as action items for later investigation or a dedicated functional exercise.
6. Empower Facilitators with TTRPG Principles: Train exercise facilitators (the "Dungeon Masters") in techniques like "leading with principles and following with rules," sharing the spotlight, and managing time effectively while embracing emergent narratives. The facilitator's role is to guide the story, encourage participation, and ensure the exercise yields actionable insights.
7. Leverage Internal Expertise: Recognize that developers, sysadmins, and other operational teams are invaluable Subject Matter Experts (SMEs). Their insights into obscure systems, legacy configurations, and internal processes can reveal critical attack avenues that security teams might overlook. Encourage their participation and listen to their "what if" questions, as these often point to real-world weaknesses.
8. Cultivate a Security-Positive Culture: By making tabletop exercises fun, engaging, and collaborative, organizations can significantly improve their overall security culture. When security is seen as an exciting challenge rather than a boring chore, it encourages greater participation, cross-departmental collaboration, and a proactive mindset toward risk management.
9. Generate Actionable Insights: The ultimate goal is to generate concrete action items that lead to tangible improvements. This includes documenting undocumented procedures, verifying control effectiveness (e.g., "does this EDR block DNS traffic?"), updating incident response plans, and identifying training needs. The "cool action item" approach ensures that potential gaps are recorded for follow-up without disrupting the exercise flow.

By adopting these defensive implications, organizations can transform their tabletop exercises from a compliance burden into a powerful tool for continuous improvement, robust incident preparedness, and a stronger overall security posture.

Key Takeaways

• Reframe Tabletop Exercises: Don't view tabletop exercises as mere compliance checkboxes. They are opportunities for engaging, collaborative learning and should be designed to be fun and effective.
• Design Sophisticated Scenarios: Create realistic, multi-layered scenarios with motivated, adaptive threat actors, considering their contingencies and pre-incident activities, much like crafting a rich D&D campaign.
• Embrace Player Agency and Nonlinearity: Allow participants to make unexpected decisions and adapt the narrative dynamically. Avoid rigid, linear scripts; instead, foster collaborative storytelling that mirrors the unpredictable nature of real incidents.
• Prioritize Psychological Safety: Cultivate an environment where team members feel safe to make mistakes and openly discuss assumptions. This encourages genuine participation and helps uncover critical gaps in a low-risk setting.
• Focus on Facilitation, Not Just Scripting: The "Dungeon Master" (facilitator) is key. They should guide the discussion, manage time, encourage participation from all, and capture follow-up "action items" without getting bogged down in minute technical debates during the exercise.
• Leverage Internal Expertise: Recognize that developers, sysadmins, and other operational teams are invaluable Subject Matter Experts (SMEs). Their insights into obscure systems and processes are crucial for identifying realistic attack paths and potential vulnerabilities.

About the Speaker(s)

Colby Prior is a Security Engineer at Octopus Deploy, where he applies his expertise to enhance organizational security. Beyond his professional role, Prior is an active member of the local security community, contributing to the organization of sec talks Brisbane, a monthly event for security professionals and enthusiasts. His unique perspective on cybersecurity is significantly shaped by his extensive experience with Dungeons and Dragons, which he has played since the third edition. Prior leverages principles from Tabletop Role-Playing Games (TTRPGs) to advocate for more engaging, effective, and fun approaches to security practices, particularly in the realm of tabletop exercises.