I have facilitated executive tabletop exercises for the better part of twenty-five years. Some, while still productive, have been fairly par for the course. But some have been transformative,  changing how a leadership team thinks about risk, response and its own ability to make hard decisions under pressure. The exercise we ran a couple of weeks ago belongs in that last category.

The reason it was so successful is in large part thanks to something I have been quietly building for months: a platform that brings large language models (LLMs) into the room with the facilitator. Not to replace the person leading the exercise. Not to automate judgment. Not to turn a human conversation into a machine-led process. The purpose is much more practical than that. The platform captures what happens in the room while it is happening, helps the facilitator see patterns sooner and turns the discussion into structured evidence while the urgency is still fresh.

After this first live deployment, I am convinced we are looking at a different way to run executive tabletop exercises.

The Thing I’ve Always Wanted

Tabletop exercises have always been a balancing act. You want the room thinking hard, the conversation moving and the right questions landing at the right moment. You want leaders to be candid without turning the session into theater. You want the group to stay grounded in the scenario, but you also want them to say the things that reveal how the organization really works under pressure.

At the same time, the room is producing a huge amount of signal. Decisions. Assumptions. Gaps. Strengths. Role confusion. Vendor concerns. Escalation failures. Cultural habits. Quiet comments that may sound small in the moment but later become central to the after-action report. A good facilitator is listening for all of it while also managing the room, watching the clock, guiding the scenario, reading body language and deciding where to push next.

Some of that signal gets captured. Some of it lives in the facilitator’s memory. Some of it gets reconstructed later from notes, recordings and judgment. By the time the after-action report is drafted, reviewed, polished and delivered, the energy from the exercise has usually cooled. The leadership team has moved on. The hard truths get softer. The opportunity to act narrows.

That has always bothered me, because the value of a tabletop is not only in the discussion itself. It is in what the organization does with the discussion afterward. If the best observations arrive weeks later, the client loses momentum. What I always wanted was a way to preserve the full signal without slowing down the room. A second set of ears that never misses a comment. A note-taker that captures nuance without editorializing. An analyst that can hold hundreds of threads at once and show which ones are starting to matter.

For most of my career, that was not realistic. It is now.

What the Platform Does

The platform listens, transcribes and analyzes the exercise in real time. It runs locally, so the exercise conversation does not leave the room. As the discussion unfolds, several LLM-powered analysis passes run in parallel, each focused on a different part of the exercise.

One pass extracts findings as they appear in the transcript. It listens for the things tabletop exercises are designed to surface: gaps, concerns, strengths, decisions, action items and important informational notes. Each observation is categorized and severity-tagged as it appears. By the end of the day, we have a structured inventory of what the room actually said.

Another pass watches engagement and topicality across the exercise. Is the room leaning in or checking out? Are people still working the scenario, or have they drifted into side issues? A good facilitator can feel some of this in the room, but the platform makes it visible. That matters because tabletop exercises are not only about whether people answer questions correctly. They are also about how the room behaves as pressure rises.

The adaptive question generator is the part that changes the facilitator’s job the most. It is not a script. It reads what the room has said so far, understands where the scenario is designed to go and continuously proposes questions to push the discussion deeper. The facilitator can use, edit or ignore those questions. The human still leads the room. The platform keeps the next strong question close at hand.

The system also tracks context throughout the exercise. It maintains the scenario state, participant roster, organizational background and exercise objectives. That keeps the models grounded in the institution in front of them rather than drifting into generic advice. At the end of the session, a post-exercise synthesis turns the day’s output into usable deliverables: transcript, findings index, sentiment trajectory, executive summary and report structure. The material that used to take weeks to assemble is available while the exercise is still fresh.

The First Live Run

We ran the platform live for the first time during a recent executive tabletop exercise. By the end of the day, the system had captured a complete transcript covering every module and the hotwash debrief. It extracted dozens of meaningful observations, including three tagged as critical. It scored sentiment across more than 200 distinct discussion segments. It also generated more than 470 adaptive questions during the exercise, with five active questions rotating on the facilitator’s iPad in their hand in real-time.

The sentiment curve was especially useful. As the scenario escalated, the team’s engagement rose with it. That is not always what happens under pressure. In some rooms, stress narrows the conversation. People retreat into their own lanes. The discussion becomes safer, more procedural and less honest. That did not happen here. This group leaned in as the pressure increased, and the platform showed that movement clearly.

The after-action report, which has traditionally required two to three weeks of careful drafting, became a same-week deliverable. That alone would have been meaningful, but the stronger validation came after the exercise. The participant survey independently converged on the same themes the platform had already documented. The room’s self-assessment and the system’s analysis pointed to the same issues.

This told us the platform was not just producing volume. It was preserving the signal that mattered.

The Moments That Stayed With Me

A participant made a quiet comment that could have disappeared into the noise. The findings extractor connected it to three earlier observations I had not consciously linked yet. That connection became one of the headline findings in the final report. The platform had the thread before I did.

The CEO said, out loud, that he had reached zero confidence in a critical vendor. The room went quiet. The sentiment trajectory captured the shift cleanly. Later, we could point to the exact moment when the institution’s posture toward that vendor changed.

When I sat down to begin the report after the exercise, I realized the hard part had already happened. The structure was there. The evidence was there. The themes were there. The participant survey aligned with the system’s output. I was not reconstructing the day. I was editing the record.

After decades of doing this work, that felt new.

What This Is, and What It Is Not

This was the first live deployment of the platform. It will not be the last. Every exercise from here forward will make it better. We will refine the models, tune the categories, improve the question generator and measure how much synthesis the platform can handle before a human pass is required.

But the core idea has been proven. LLMs do not replace the facilitator. They do not create candor. They do not build trust in the room. They do not make executives willing to say hard things out loud. They do not understand the politics, pressure and history inside an organization the way an experienced facilitator can. That is still human work.

What the platform does is make sure the work is not lost. It catches the comment that would have slipped through the cracks. It shows the shift that would have lived only in the facilitator’s memory. It turns a day of executive discussion into structured evidence while the organization still has the appetite to act.

There is a lot of noise right now about what AI will do to cybersecurity. Much of it focuses on how attackers will use it. This is a story about the other side. Some of the most useful applications of LLMs in cybersecurity will not be flashy. They will be quiet, practical and structural. They will help experienced practitioners do work that was previously too fast, too complex or too lossy to capture well.

This platform is one of those applications, and I cannot wait to run the next exercise with it.

If your organization runs executive tabletop exercises, or has been told it should, we would welcome the opportunity to show you what they look like when LLMs are in the room supporting the process. The technology is interesting. What it gives the leadership team is better.

‍

Published By: Chris Neuwirth, VP of Cyber Risk, NetWorks Group

Publish Date: May 28, 2026