How to Design a Counterintelligence Tabletop Exercise That Produces Action

A counterintelligence tabletop exercise is a facilitated discussion that tests how people recognize, report, assess, and manage a simulated threat. It should be built around a small number of measurable objectives, realistic information updates, and decisions participants may actually face. The value comes after the discussion, when observations become assigned improvements to policy, training, communication, or investigative support. Kensington Security Consulting uses collaborative education and case-based learning to help organizations move beyond passive awareness and examine how their procedures hold up when information is incomplete.

Define What the Exercise Must Test

Start with two or three capabilities, such as recognizing insider indicators, sharing information across departments, protecting sensitive material, or escalating a concern. Avoid trying to test the entire security program in one session.

Write an objective in observable terms: “Participants will identify the reporting path and decide whether to convene a multidisciplinary review within the simulated timeframe.” Clear objectives help facilitators distinguish a true capability gap from an interesting side discussion. Kensington’s working groups and study sessions can be tailored around the audience’s actual responsibilities.

Build a Plausible Scenario With Decision Points

The scenario should reflect the organization’s mission, information environment, and authorities without copying a sensitive real case. Begin with ordinary conditions, then introduce changes that require interpretation. Each inject should force a decision, request, or coordination step.

Useful injects may include an access anomaly, an unsolicited foreign contact, conflicting supervisor reports, suspicious information collection, or a public allegation that changes the operational context. The sequence should leave room for multiple reasonable choices instead of guiding participants to one obvious answer.

Give Participants Imperfect Information

Real incidents rarely arrive as complete narratives. Provide partial, uneven, and sometimes conflicting information so participants must identify gaps and decide what to seek next. Do not use deception merely to surprise them. Every ambiguity should connect to an objective.

A behavior-based hostile indicators checklist can give participants a shared method for documenting observations while preserving the difference between an indicator and a conclusion.

Evaluate Decisions, Coordination, and Rationale

Observers should record what participants noticed, which authorities they consulted, how information moved, and why decisions were made. The goal is not to embarrass individuals. It is to understand whether the system supports sound performance.

Pay close attention to handoffs. Many weaknesses appear between security, operations, legal, human resources, information technology, and leadership. Prior coverage of joint-operation counterterrorism gaps shows why unspoken assumptions about ownership can create blind spots.

Turn the After-Action Review Into Assigned Work

End with a small number of findings tied to evidence from the exercise. For each improvement, name an owner, due date, success measure, and validation method. Some issues require a policy update; others call for training, contact-list changes, or a second exercise.

Keep a separate list of strengths worth preserving. A tabletop should show what already works as clearly as it identifies gaps. Schedule a follow-up review so the after-action report does not become a document that is filed and forgotten.

Frequently Asked Questions

How long should a tabletop exercise last?

A focused session can run two to four hours. Complex multi-agency exercises may require a full day or several linked sessions.

Should senior leaders participate?

Yes, when the objectives involve authorities, resource decisions, public communication, or cross-organizational coordination.

Does a tabletop replace operational drills?

No. It tests discussion, decisions, and coordination. Functional or full-scale exercises are needed to validate physical execution.

How often should exercises occur?

Use a schedule based on risk, staff turnover, mission changes, and lessons from incidents, with follow-up exercises after major corrections.

Test the Decisions Before a Real Incident Does

Kensington Security Consulting can develop tailored case studies, working sessions, and educational exercises for counterintelligence and terrorism-related challenges.

Kensington Security Consulting's products and services provide additional context. When you are ready, contact the team to discuss the mission, audience, and next step.

Suggested button: Plan a Tabletop Exercise