Tabletop exercises answer one question: when something breaks, will the people responsible for fixing it do the right thing, in the right order, fast enough? For years, the answer depended almost entirely on humans: their training, runbooks, and their judgment under pressure. We assumed the tooling around us was static. We have always tested the people because the people were the variable.

At Webflow, we’ve spent a year building AI into the parts of incident response that used to be purely human: triaging alerts, pulling the right playbook, proposing responses, and even drafting PIA (Post Incident Analysis) and its follow-up items. 

We’ve written before about how this multiplied our security team rather than replacing it, but there’s a consequence of that shift we don’t see many teams grappling with yet. If AI is now doing real work during an incident, AI is now part of what a tabletop has to test. Not just whether your responders know the runbooks, but whether the system that’s supposed to hand them the runbook actually does, and does so correctly, under the same pressure that used to only apply to humans.

This isn’t just a security team problem. Any team that has quietly let an AI system become part of its response (support routing customer escalations, SRE triaging outages, IT auto-resolving access requests) has the same untested dependency sitting in its process. If your tabletop exercise formats haven’t changed since you injected AI into your systems, you’re testing a team that no longer exists, and that leaves you blind to gaps.

Source link