Incident response and tabletop exercises are the software and the practice a company uses to handle a cyber attack as a team, and to rehearse one before it happens. An incident is any event that harms, or may harm, a company's systems or data, such as a stolen password or a ransomware attack.
When an incident is confirmed, many people have to work together quickly. The security analysts, the IT team, the lawyers and the managers all need the same facts. Incident response software gives them one shared space, often called a war room. It holds a timeline of everything that has happened so far. It holds the list of tasks, with the name of the person doing each one. And it holds the evidence collected so far. SOAR adds every automatic step it took, such as disabling an account, to the same timeline.
In India, there is also a deadline. Under CERT-In's 2022 rules, a company must report many kinds of cyber incidents to CERT-In, the government's cyber security agency, within 6 hours of noticing them. Banks must also report incidents to the RBI. So the war room also tracks what was reported, to whom, and when.
A tabletop exercise is a rehearsal of an attack, done around a table or on a video call. No real systems are touched. A facilitator describes a made-up attack, step by step, and the team says what each person would do at each step. Imagine a tabletop exercise at an online grocery company in Gurugram. The facilitator says: "It is 7 a.m. on a Saturday. The servers that run your delivery app have been encrypted, and a note asks for ₹25 crore to unlock them." Within twenty minutes, the team finds two gaps. Nobody knows who may approve shutting down the payments system. And the phone numbers for the backup team are out of date. The company fixes both before any real attack.
After the attacker is shut out, digital forensics works out exactly what happened. The war room records these findings in the final report. When an incident also affects buildings and staff, such as a fire or a flood, companies use critical event management to alert their employees and check that everyone is safe.