A video-led tabletop exercise for boards, executive teams and CTOs, built from your own StackUp data and your own recent news. Make the calls. See what they cost. Get the score.
Free to run. Nobody you invite needs an account.
Better decisions were worth 290k - 550k.
Harbourline Freight kept 18,000 customers in the dark for six days after AI data leak
Illustrative debrief · fictional organisation
The problem
They have read about one. They have approved a policy about one. Almost none have sat in the room while it happened and found out what they would actually decide.
Regulators expect boards to test how the organisation operates through severe but plausible scenarios, and directors' duties apply to technology risk like any other. A tabletop is how you evidence that you looked.
Every board has run, or been told to run, a cyber exercise. Very few have rehearsed a staff member pasting customer data into a public model, or a deepfake of the CEO approving a payment.
And costs tens of thousands, and is written for a generic company. Ours takes twenty minutes, is built from your own answers, and can be run again next quarter to see if anything changed.
The scenarios
Your assessment answers tell us where you are weakest. The recommended scenario comes with the reason. You can pick another.
A well-meaning manager pastes a customer export into a public AI tool to clean it up. Three days later a security researcher finds it. Then a journalist does.
Finance takes a video call from the CEO approving an urgent supplier change. The money moves on Friday afternoon. On Monday the real supplier calls.
Monday, 6am. Every screen shows the same note. The backup server is on the same network. The insurer wants a call before anyone touches anything.
Next in the library: a critical vendor outage, a customer-facing AI that gives harmful advice, and a competitor launching an AI product the morning of your board meeting.
How it runs
Four injects, each with a video, a situation card written for your organisation, and a decision the room has to make.
Pick your lens: board, executive team or CTO. Confirm six facts about your organisation, approve the news we found, then run it now or put it in the diary. Invite the room by calendar invite. Nobody but you needs an account.
A short video sets the scene, addressed to your organisation: your size, your sector, the story that was in the news last month. Your first call is coming in.
Each one is a 60-second video, a situation card written for you, and a decision. Your real posture decides what happens next. If your backups are rated Poor, restoring from backup does not save you.
Your Response Effectiveness Score. What your path cost against the best and worst paths. The headline your choices earned. What it means for your role and for your customers. The three factors that decided it, and the plan that fixes them.
Your posture changes the outcome. Two organisations can make the same call and get different results, because one has tested backups and one has a policy nobody has read. Where we have to assume, we tell you, and we tell you which assessment would replace the assumption.
What you walk out with
All of this is in the free debrief. It is the proof of the problem.
0 to 100 across containment, governance, communication, compliance and recovery, banded the same way as every StackUp score.
Your path, the best path and the worst path, in your currency, with every assumption named and editable. The gap is what better decisions were worth.
The headline your choices earned, a trust impact score, and how many customers heard about it from someone other than you.
The three questions you will be asked, the decision you would want minuted, and what your insurer or auditor will now require.
How long service was down, what was exposed, what they were told and when, and what a reasonable customer now expects.
Named, rated, and traced to the assessment that measures each one. Where we had to assume, we say so, and show what an assessment would change.
Eight to twelve actions that fix the factors behind your outcome, sequenced, with an owner, an effort band, a timeframe and the effect each has on your score and your ledger. One click puts them in your Action Planner. The factors behind them are tracked, so you know the moment your exposure changes, and a reminder brings you back in 90 days to see whether the outcome did.
Run the recommended scenario once, with the room you invite. Keep the score, the ledger, the headline and what it means for you. See the size and the value of the plan, and decide whether you want it.
Built from your data
Everything StackUp already knows about your organisation feeds the exercise, and the exercise tells you what it wishes it knew.
Backups, incident response, training, vendors
Governance, data, people, risk rating
Where your leaders disagree
What your people said in interviews
Sourced, shown to you, never invented
Not assessed yet? Six quick facts are enough to start. The debrief shows you exactly which answers we had to assume, and which assessment would replace the assumption with your real posture.
Who it is for
Choose the lens at the start. The scenario is the same; the decisions and the debrief are written for the seat you sit in.
Decisions are framed as oversight: what you ask management, what you approve, when you disclose. The debrief speaks to directors' duties and continuous disclosure, and gives you the minute you would want on record.
Decisions are trade-offs: keep trading or stop, what to tell customers, who owns it. The debrief covers revenue, customers, staff, and what the chair asks on Monday.
Decisions are operational: isolate, restore, escalate, who to tell and when. The debrief makes the budget case the incident makes for you, before the incident does.
Put it in the diary. Schedule the exercise, add the people you want in the room, and StackUp sends each of them a calendar invite in your name with a short pre-read. Afterwards, share the results with them, or with anyone else who should see them, in one click.
Questions
Run your first StackUp Tabletop free. Twenty minutes, your data, your score.