Research and Practice of Delivering Tabletop Exercises
Jan Vykopal, Pavel Čeleda, Valdemar Švábenský, Martin Hofbauer, Martin Horák
TL;DR
The paper addresses the limited adoption and uneven study of tabletop exercises (TTX) in computing education, particularly for cybersecurity and IT/OT operations. It conducts a systematic literature review of 140 candidate papers and provides an in-depth analysis of 14 that meet criteria, covering formats, participants, development, assessment, and practical application. Key findings show inject-based scenarios predominate, with mainly manual development and evaluation and few reusable educational artifacts or software tools; guidelines like NIST, ENISA, and ISO 22398 are variably applied. The authors propose future directions including online tooling, automated content generation using AI, and shared open resources to scale TTX adoption in higher education.
Abstract
Tabletop exercises are used to train personnel in the efficient mitigation and resolution of incidents. They are applied in practice to support the preparedness of organizations and to highlight inefficient processes. Since tabletop exercises train competencies required in the workplace, they have been introduced into computing courses at universities as an innovation, especially within cybersecurity curricula. To help computing educators adopt this innovative method, we survey academic publications that deal with tabletop exercises. From 140 papers we identified and examined, we selected 14 papers for a detailed review. The results show that the existing research deals predominantly with exercises that follow a linear format and exercises that do not systematically collect data about trainees' learning. Computing education researchers can investigate novel approaches to instruction and assessment in the context of tabletop exercises to maximize the impact of this teaching method. Due to the relatively low number of published papers, the potential for future research is immense. Our review provides researchers, tool developers, and educators with an orientation in the area, a synthesis of trends, and implications for further work.