Recommended Free Tools
In an AI-related tabletop, the familiar incident-response decisions still matter: assess impact, coordinate across roles, contain and recover, communicate, and improve the plan. What changes is the scope of the incident and the questions participants must answer: whether AI systems, their data, integrations, or downstream services are affected; what evidence is needed to understand the event; and what can be shared with providers and other partners. This guide focuses on incidents involving AI systems or AI-enabled services—not on using an AI assistant to help responders investigate an otherwise conventional incident.
What changes—and what stays the same?
An AI-related tabletop should extend the organization’s incident-response exercise, not replace it with a separate discussion about AI. Start with the same core work participants would face in a conventional incident: recognize and assess the event, make response decisions, communicate across roles, preserve useful information, and identify improvements. Then add decision points that test whether the team understands the AI-related systems and dependencies involved and can coordinate with outside parties.
As an Amazon Associate I earn from qualifying purchases.
The distinction is practical. In a conventional scenario, participants may focus on affected enterprise systems and the people who operate them. In an AI-related scenario, they may also need to determine whether an AI system itself, a system enabled or created by AI, or information stored on either is affected. Integrations and downstream services may matter too. CISA’s 2024 Joint Cyber Defense Collaborative (JCDC) exercise framed an AI cybersecurity incident around actual or imminent harm to the confidentiality, integrity, or availability of those systems or information where disruption requires intervention. That is a useful way to set the exercise boundary, rather than treating every error or unexpected output as an incident by default. CISA’s JCDC AI Cyber Tabletop Exercise scenario document
| Tabletop dimension | Conventional incident emphasis | Additional AI-related emphasis |
|---|---|---|
| Scope | Enterprise systems, information, and services affected by the scenario. | Also determine whether an AI system, an AI-enabled or AI-created system, its information, integrations, or dependent services may be affected. |
| Assessment | Establish what happened, what is affected, and what decisions are needed. | Ask what evidence could distinguish an AI component issue from a conventional infrastructure incident, and what context is missing. |
| People and dependencies | Coordinate among the organization’s security, IT, business, and leadership roles. | Identify system owners and decide whether an AI provider, developer, specialist, or external partner must contribute information or decisions. |
| Information sharing | Use the organization’s established communication and escalation procedures. | Decide what incident details can be shared with which partners, when, and through what established channels and protections. |
| Plan review | Test whether existing response roles and procedures work under pressure. | Check whether those roles, procedures, contact lists, and escalation paths cover AI-related systems and dependencies. |
The table is a planning aid, not a claim that every AI incident follows the same pattern. CISA’s exercise objectives included information sharing, response to multistage AI incidents, improvements to plans and resilience, and collaboration across government, industry, and international participants. A facilitator can translate those objectives into scenario decisions appropriate to the organization’s own systems and partners. CISA’s JCDC AI Cyber Tabletop Exercise scenario document
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Set the exercise boundary before writing injects
“AI incident” can mean several things. For this tabletop, define whether the event concerns an AI system or an AI-enabled service, information associated with it, or a conventional system whose disruption affects an AI capability. State what is in scope and what participants are expected to decide. That stops the exercise from drifting into a broad debate about AI or treating every unexpected system behavior as proof of compromise.
Also distinguish an incident involving AI from an incident in which responders themselves use AI tools. The CISA and NIST materials cited here address incident response and AI-related cybersecurity coordination; they do not establish a detailed framework for assessing AI tools used by responders. If responders’ use of such tools is part of the scenario, define that as a separate exercise question rather than assuming it is covered by the AI-system incident scope.
Map the affected service, not just the model
Before the session, identify the AI-related capability at the center of the scenario and map the systems and responsibilities participants may need to discuss. The map can be simple: the AI system or service, relevant information, integrations, downstream services, and the organizational owner for each. The goal is not to create an exhaustive technical inventory during the exercise. It is to make ownership and dependencies visible enough that participants can identify who must assess an impact or make a decision.
- Which AI-related system or service is central to the scenario?
- What information, integrations, or dependent services could be affected?
- Who owns each relevant system or business service?
- Which facts are known at the start, and which are deliberately uncertain?
These are facilitator design questions, not a prescribed CISA checklist. They apply the scope and collaboration objectives in CISA’s JCDC exercise to a local exercise plan.
Keep the familiar incident-response backbone
Use current general incident-response guidance as the baseline. NIST finalized SP 800-61 Rev. 3 in April 2025, aligned it with the Cybersecurity Framework 2.0, and superseded Rev. 2. NIST describes incident response as integrated across organizational cybersecurity risk management. For a tabletop, that means the AI-specific questions should sit inside the organization’s broader risk and response arrangements rather than becoming a disconnected technical exercise.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Retain the decisions your existing plan expects participants to make. The exact stages and terminology should follow your organization’s plan, but the exercise should still test whether participants can recognize and assess the event, agree on response actions, coordinate communication, preserve useful information, and recover or improve as appropriate. Do not make the AI element so dominant that the team never practices its normal escalation and decision paths.
A tabletop is a discussion-based test, not a technical demonstration. Participants should explain what they would do, who would make or approve a decision, what information they need, and how they would communicate. The facilitator can reveal new facts over time, but should not silently resolve the questions the team is meant to confront.
Build AI-specific decisions into the scenario
Rather than adding AI vocabulary to a conventional scenario, create injects that force a real decision. An inject is a new piece of information or development introduced during the exercise. For each one, decide which uncertainty it tests, who needs to respond, and what a useful answer would reveal about the plan. The examples below are proposed facilitation prompts based on CISA’s exercise objectives; they are not verbatim CISA requirements.
Inject 1: Define what may be affected
Give participants an initial report that points to a problem with an AI-related service but does not yet establish its full scope. Ask them to identify potentially affected systems, information, integrations, and downstream services, and to name the owners they need to contact. The exercise is testing whether the team can investigate the boundary of the incident without assuming either that the AI component is the only affected asset or that the event is merely a conventional infrastructure problem.
Inject 2: Test the evidence and context available
Introduce information that leaves the cause or extent uncertain. Ask what evidence would help distinguish a problem in an AI component from an issue in the surrounding infrastructure, what information the team already has, and what it still needs. Then ask which decisions can be made on the current evidence and which require input from a provider, developer, or specialist.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
The exercise should test whether participants know how to request or locate relevant information under their own procedures. Do not present a particular log, metric, or technical artifact as universally required: the sources used here do not prescribe a universal AI-incident evidence set. The useful outcome is a clear account of the evidence gap, its owner, and how the team would proceed while uncertainty remains.
Inject 3: Expand the incident across dependencies
Reveal that a connected service or another organization may be affected, or that the event has developed through more than one stage. Ask participants to update their assessment, identify newly affected parties, and determine whether existing escalation and response procedures still fit. CISA’s JCDC exercise explicitly included the objective of examining procedures for multistage AI incidents, so a tabletop can use this kind of development to test whether the team revisits its scope as facts change. CISA’s scenario document
Inject 4: Make information sharing a decision
Introduce a request for information from a partner, or a need to alert an external party. Ask what the organization can share, with whom, when, under what protections, and through which established channel. The point is to make information sharing a concrete response decision—not an assumed activity—and to expose any uncertainty about approval, contacts, or handling procedures.
CISA’s January 14, 2025 announcement describes the JCDC AI Cybersecurity Collaboration Playbook as providing voluntary information-sharing processes for AI cybersecurity incidents and vulnerabilities. The announcement says the playbook delineates information-sharing protections and mechanisms and outlines CISA’s actions when it receives information. Treat it as a coordination aid alongside your own incident response plan; do not substitute it for the organization’s internal authority, escalation, or communications procedures. CISA’s announcement of the JCDC AI Cybersecurity Collaboration Playbook
Include the people who can make the decisions
An AI-related tabletop is not only a security-team exercise. CISA recommends including senior business leadership as well as security and IT in incident plans and exercises. That matters because participants may need to weigh service impact, business priorities, response authority, and external communication—not merely describe a technical investigation. CISA’s guidance for corporate leaders and CEOs and CISA’s four cybersecurity goals
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
For an AI-related scenario, identify which additional participants may have relevant ownership or information. Depending on the organization and scenario, that could include an AI service provider, a developer, a specialist, or an external partner. Their participation is not automatically necessary for every exercise. The facilitator should decide whether the scenario requires their direct involvement or whether internal participants should instead practice the contact, escalation, and information-request process.
- Security and incident leadership: assess the event, coordinate the response, and identify decisions that need escalation.
- IT and system owners: explain the affected environment, integrations, and service dependencies.
- Business leadership: weigh organizational impact and participate in decisions assigned to leadership under the plan.
- AI-related owners or external parties: clarify their role in providing information or coordinating action when the scenario requires it.
Make each role’s authority clear enough to test, but do not invent a universal division of responsibilities. The organization’s own plan and agreements determine who can make particular decisions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A practical sequence for planning and running the tabletop
CISA’s CTEP package includes planner and facilitator/evaluator handbooks, feedback forms, an exercise-brief slide-deck template, and an after-action report template. Its package page lists a February 2, 2023 revision date. Those materials can provide structure for the exercise; adapt the content to the organization and the AI-related decisions being tested. CISA’s CTEP package documents
- Choose a learning objective. Select one or more concrete questions, such as whether the plan identifies affected AI-related dependencies, whether the team can request useful information, or whether the right people know how to coordinate external sharing.
- Set the scope and assumptions. Define the AI-related system or service, the type of potential harm, the organizational boundary, and what participants know at the start. Identify anything deliberately outside the scenario.
- Assign roles and decision authority. Invite the participants needed to discuss the objective. Mark who is exercising, who is facilitating, and who is observing or evaluating. Make clear when the scenario expects a decision from leadership or a system owner.
- Write a small sequence of injects. Start with a report, then introduce new evidence, a dependency or scope change, and a coordination or sharing decision if those fit the objective. For every inject, note the decision it is intended to prompt and the plan element it tests.
- Brief participants and facilitate discussion. Explain the exercise boundaries and ground rules. Present one development at a time, ask who acts and what they need, and record unresolved questions rather than resolving them on the team’s behalf.
- Capture observations as they arise. Record where ownership was unclear, what information participants sought, which procedures or contacts they used, and where a decision stalled. Distinguish a genuine plan gap from a detail outside the exercise’s scope.
- Turn observations into changes. Use a debrief and after-action report to assign improvements to a plan, contact list, evidence-handling step, escalation path, or future exercise. Give each action an owner and a way to verify it was completed.
CISA advises periodically testing incident response plans in realistic conditions, including through tabletops, and updating plans after testing. The value is not the exercise document itself; it is whether the team identifies and follows through on improvements. CISA’s 2025 incident-response engagement lessons
Free tools Windows power users keep installed
One-click scans. No signup required.
Questions for the facilitator and evaluator
Use a short set of prompts to keep discussion focused on decisions and plan performance. They are proposed questions informed by the scope and coordination themes above, not a checklist CISA requires every organization to use.
- What AI-enabled systems, information, integrations, and downstream services might be affected, and who owns each?
- What evidence or context would help participants distinguish an AI component failure or compromise from a conventional infrastructure incident?
- Which decisions can participants make from the information available, and what requires provider, developer, or specialist input?
- Who needs to be involved across security, IT, business leadership, AI-related owners, and external partners?
- What information can be shared, with which partners, under what protections, and through which established channels?
- Which plan, contact list, evidence-handling step, or escalation path should change as a result?
Evaluators should look for observable outcomes: whether participants identify owners and dependencies, explain what they need to know, use or locate the relevant procedure, and surface a decision that cannot yet be made. That produces more actionable findings than judging a team by whether it guessed the scenario’s hidden cause.
Scale the exercise to the organization
A tabletop does not need a large cast or a complex scenario to reveal a gap. CISA notes that smaller organizations can benefit from simple rehearsals or spoken walkthroughs and recommends matching the format to the team’s size and resources. A small team can discuss one AI-related service, name its owner and dependencies, and walk through who would be contacted as the facts change. CISA’s corporate-leader guidance
For a larger organization or a cross-organization exercise, add roles and coordination decisions only where they serve the objective. CISA’s JCDC AI exercise sought collaboration among government, industry, and international participants. The JCDC playbook says it incorporates feedback from approximately 150 participants across U.S. federal agencies, private industry, and international government organizations during two exercises in 2024; that figure describes feedback across the two exercises, not attendance at either one individually. CISA’s January 2025 playbook announcement
What a useful after-action result looks like
Conclude by recording specific gaps and assigning follow-up. A useful finding says what participants could not do, why the current plan or process did not support them, and what change should address it. Examples include clarifying who owns an AI-related dependency, updating a contact or escalation path, documenting how to request information from a provider, or defining who approves information sharing. These are examples of possible findings, not claims that every organization needs each change.
Separate a procedural gap from a knowledge gap. If the plan names the responsible role but participants do not know where to find it, the fix may involve access, training, or rehearsal. If the plan does not establish an owner or decision path, the organization may need to revise the plan or its agreements. Then choose a follow-up exercise or review that can show whether the change worked. CISA’s guidance to test plans and update them afterward supports treating the debrief as part of response readiness, rather than the end of the exercise. CISA’s incident-response lessons
Bottom line for exercise designers
Keep the established incident-response backbone and use the AI-related element to test what a conventional scenario may not expose: incident scope across AI systems and dependencies, evidence and context needed for assessment, ownership and outside expertise, and decisions about information sharing. The best tabletop is not the one with the most technical detail; it is the one that reveals whether participants can make and coordinate the decisions their plan requires.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
