FortiGuard Tabletop Exercises (TTXs) are discussion-based cyber-incident simulations designed specifically for operational technology (OT) environments such as electric grids, water and sewer systems, fuel pipelines, power plants, and manufacturing. Instead of a live-fire drill, your cross-functional team (security, operations, leadership, and other stakeholders) walks through real-world attack scenarios that the FortiGuard Incident Response and Readiness team has actually handled. During a TTX, FortiGuard facilitators:

• Guide participants verbally through realistic OT-focused cyber incidents
• Test your existing incident response playbooks, processes, and communication flows
• Ask targeted questions about who does what, when, and based on which criteria
• Encourage open discussion so teams can explore options without the pressure of a live attack

The goal is not to “win” the exercise, but to:

• Identify strengths, weaknesses, and gaps in your current approach
• Validate whether your policies and procedures are practical in real scenarios
• Improve communication and collaboration across teams
• Build shared understanding of roles and responsibilities during an incident

At the end, you receive a final report with concrete recommendations so you can refine your incident response plan and better prepare your OT environment for future cyber incidents.

OT systems quietly run the infrastructure everyone depends on—power, water, fuel, transportation, and manufacturing. As these environments become more connected to IT networks, they are exposed to new cyber risks that traditional isolation no longer shields. Recent data points underscore the challenge:

• A study of 1 million OT devices found that 40% of organizations had at least one OT asset exposed to the internet without proper security.
• About 31% of organizations had internet-facing OT assets with known exploited vulnerabilities.
• 50% of organizations reported experiencing one or more cybersecurity incidents.

Attackers are actively targeting OT with malware families such as CrashOverride/Industroyer, Triton, and VPNFilter, and they continue to use phishing, malware, and increasingly AI-powered tactics to exploit operational weaknesses. In this context, FortiGuard TTXs help you:

• Rethink your readiness by testing how your people and processes actually perform under realistic OT attack scenarios
• Spot quantifiable gaps in your incident response playbooks before an actual incident
• Ensure that as your network, staff, and threat landscape change, your response plans evolve with them
• Use exercise outcomes to make informed decisions about updates to policies, procedures, and technical controls

In short, TTXs help you reimagine OT security from a static checklist into an ongoing practice that improves operational resilience, safety, and response readiness.

Organizations use FortiGuard TTXs to move beyond compliance and turn incident readiness into a practical, high-ROI security activity. Typical outcomes from a TTX include:

• A clearer view of what worked well in your current response approach
• Specific areas where you can improve plans, policies, and procedures
• Identified security gaps and recommended actions to close them
• Stronger team relationships and more effective cross-team communication
• Better understanding of who is responsible for which actions during an incident
• A more clear and concise incident response plan for OT environments

Service options FortiGuard offers TTXs as part of flexible service models:

• Standalone Tabletop Exercises – Ideal if you want to focus specifically on testing and refining your existing OT incident response playbooks.
• FortiGuard Incident Readiness Subscription Service – A one-year subscription that lets you choose from a suite of proactive and incident response services, such as:
  • Incident response readiness assessments
  • Incident response playbook development
  • Tabletop exercises for playbook testing
  • Offensive services (penetration testing, red teaming)
  • Digital forensics and incident response with a 1-hour service-level objective (SLO)
  Additional hours can be purchased as needed.
• FortiGuard Incident Readiness Subscription Service Lite – Includes 10 initial service points (40 hours) and a 24-hour SLO, suitable for organizations that want a lighter but structured engagement.

Whichever option you choose, the intent is to help you reshape your OT security posture based on real-world experience, so your incident response capabilities can evolve alongside your enterprise and the broader threat landscape.