What Is an Incident Response Drill? Types, Frequency, and How to Run One
An incident response drill is a practice run of your IR plan. The team walks through a fake but realistic attack. The goal is to find the plan's weak spots before a real incident does. Here are the drill types, how often to run each, and how to run one that finds real problems.
Key takeaways
- A drill tests choices, not tools. The goal is a list of gaps. Gaps in the plan, the contact list, and the pre-approvals. You find them while nothing is on fire.
- Three main types, by depth. A tabletop is a talking exercise. A walkthrough steps through a test system. A simulation runs on real systems with surprises and a clock.
- NIST 800-61 puts drills in the prep phase. Drills keep the plan alive. A plan that is never tested is just a paper trail for audits.
- A rhythm that works. Run a tabletop every quarter. Run one deep technical drill each year. After any real incident, fix the plan based on what happened.
What a drill really is
Take a scene that could happen to you. Ransomware on a file server. Stolen login names from a phishing email. Odd traffic in a factory network. Then walk the team through the plan. Who calls the incident? Who decides? Who contains it? Who calls the lawyer? Who tells the insurer? The scene is written ahead. The answers are not.
A drill has one measure of success. The list of plan promises that failed in practice. A contact who left the company. A pre-approval legal never gave. A log feed that expired. A notice deadline the team could not meet with the data on hand.
NIST SP 800-61 puts exercises in the prep phase for this reason. Prep is the only phase you fully control. A drill is prep with feedback.
The drill types
| Type | What happens | What it finds |
|---|---|---|
| Tabletop | A reader walks the team through a scene at their desks. No systems are touched | Plan gaps, role mix-ups, missing pre-approvals |
| Walkthrough | The team steps through the plan in a test system with a set scene | Whether the playbooks match how systems really act |
| Simulation | Real systems, a strict clock, and surprises. A server fails mid-fix. The lawyer is "out" | Speed, teamwork, and grace under pressure |
| Purple-team | A red team runs safe attack moves. The blue team spots and reacts live | Detection holes and how playbooks hold up against real moves |
How to run a tabletop that finds real problems
Before: Pick a scene that fits your world. Cloud, OT, or both. Note that the fix steps differ by world. If your plan treats them the same, that is your first finding. Pick a facilitator who is not part of the response team. Invite everyone the plan names. That includes legal. The drill should test the contact tree, not just security.
During: The facilitator reads the scene in stages. After each stage, ask: what do you do now? Under what power? Every answer that starts with "I would check with..." is a finding. The plan did not pre-approve that call. Track the time for each stage. If the pace feels bad, that is data too.
After: The debrief lists gaps. Each gap gets an owner and a due date. Then the plan gets fixed. A drill that ends with no plan changes was a meeting, not a drill.
Common mistakes
- Running the drill without legal or comms present. Then a real incident shows you need the lawyer from hour one.
- Testing only the tech side. The drill should also test the outside-resources page. Can you reach the retainer firm? Do you know your carrier's panel rules?
- Calling it a win because the tools worked. The plan's job is sound calls under set power. A working tool is not proof of a working plan.
- Skipping OT drills because they feel risky. Tabletops carry zero risk to systems. They still find the gaps that matter there.
Frequently asked questions
How often should we drill? A tabletop each quarter keeps the plan warm. One deep technical drill a year tests the playbooks. After every real incident, hold a review and fix the plan. That review is a drill in hindsight.
What scene should we pick first? The one your insurer loses sleep over. For most, that is ransomware with data theft. It touches every part of the plan at once. Containment, legal privilege, notice deadlines, insurer calls, and outside firms.
**Do outside firms join drills?** The good ones do. Retainer firms that run tabletops with you are practicing the same teamwork a real incident needs. Ask for it in the retainer terms.
Browse documented incident response firms, filtered by carrier panel status and disclosed SLA →This guide reflects NIST SP 800-61's Preparation phase and our incident response plan template. Last verified: October 2026. Have a correction or addition? Request inclusion or a correction →
Continue reading
Best Incident Response Companies 2026: Ranked by What's Documented, Not What's Claimed
Search for the best incident response companies and you get two things. Vendor blogs that rank themselves first. And listicles that rank by adjectives. Neither survives contact with a real incident. What survives is evidence: which firms carriers' claims teams keep re-hiring, what the firms document about their own capability, and how their claims check out. This page ranks the market's most-documented IR firms. It tells you exactly what the ranking can and cannot say.
Best Operational Technology (OT) Incident Response Firms 2026: Ranked by What's Documented, Not Claimed
Search for OT security companies and you get two bad options. Vendor listicles rank whoever pays them. Vendor blogs rank themselves. The OT market deserves better, because a wrong pick costs production hours. This page lists the OT incident response firms we could verify from their own published services. It puts them in the order the evidence supports. Where the evidence is thin, it says so.