Running drills and tabletop exercises
Glassbreak Team · Published 2026-07-19
A plan you've never rehearsed is a hypothesis. Drills turn your playbooks, contact data, and escalation rules into things you know work — and they generate the evidence trail that insurers and auditors increasingly require for incident-response readiness.
Drill schedules
Rather than relying on someone remembering to run a drill, you attach a schedule to a playbook:
- Go to your team's drill schedules and create one, linking it to a published playbook or recovery plan.
- Choose a cadence: weekly, monthly, quarterly, biannual, or annual. Set the first fire date, or let it default to one cadence interval from now.
- Assign people to the drill with a role: participant, approver, or observer.
When a schedule fires, Glassbreak automatically creates a low-severity drill incident and starts a drill run of the linked document. The incident timeline and the run's step-by-step progress become your compliance evidence — no separate write-up needed. Schedules can be archived when a playbook is retired, and an occasional fire can be skipped without breaking the cadence.
Drills are deliberately contained: drill-mode activity is flagged end to end, so a practice run doesn't page people outside the assignment list or expose real secret material.
Practice runs of a document
You can also run any published recovery plan or playbook ad hoc as a drill or tabletop run — same tracked execution as a real incident, marked as practice. See Playbooks and recovery plans for how runs work.
Tabletop exercises (new)
For discussion-based rehearsal — the format cyber-insurance policies typically require annually — Glassbreak now includes a guided tabletop exercise engine:
- Create an exercise with a scenario and a participant roster.
- As the facilitator walks the team through the scenario, log the session as an ordered stream of injects (scenario developments), decisions, and actions.
- Close with an outcome summary: what worked, gaps found, and action items with owners.
- Export an auditor-ready report — machine-readable JSON or a self-contained HTML packet for your insurer.
If a live drill message-send was part of the exercise, the report includes delivery and acknowledgment metadata only — message bodies are end-to-end encrypted and never appear in a report.
A sensible cadence
Quarterly tabletops plus a monthly scheduled drill of your most critical playbook is a strong baseline. Pair each drill with a glance at contact health — stale phone numbers are the most common failure a drill uncovers.