ISC2 Express Tabletops offer an efficient way to prepare for real-world security incidents, without real‑world risk. These exercises place you in a realistic crisis scenario, encouraging critical thinking and responsive decision making as events unfold. By working through an incident with guidance from an expert member, you validate your existing processes, strengthen your organizational posture, and uncover gaps before a true emergency occurs.
Experience your training anytime, ISC2 Express Courses are delivered through on‑demand interactive branching scenarios with built‑in “check your understanding” moments. Pricing is U.S. $40, with a discounted rate for ISC2 members. Two tabletop exercises are available today, The Cloud Account No One Was Watching and The Cameras That Phoned Home with more releases anticipated.
“Express Tabletops give you the opportunity to be intentionally reactive. Users are empowered to think creatively and strategically,” said Stacy Mantzaris, Senior Director of Professional Development at ISC2. “By practicing decision making in realistic scenarios, you build the confidence and discipline needed to respond effectively when the pressure is real.”
ISC2 Express Tabletop: The Cloud Account No One Was Watching
This tabletop simulates a realistic cloud security incident that begins as a routine, low‑priority help desk issue. Participants step into the role of the incident responder and slow down the response, prioritizing investigation over immediate remediation to understand what’s happening and where evidence resides.
The exercise focuses on tracing identity activity, privilege, and data access to preserve evidence and limit impact, reinforcing an investigation first approach aligned with cloud and IAM best practices.
Designed for practitioners with a working knowledge of cloud platforms, authentication and authorization, and basic incident response, this exercise is especially valuable for incident responders, security analysts, and cloud administrators looking to strengthen investigative decision-making in identity‑driven incidents.
ISC2 Express Tabletop: The Cameras That Phoned Home
This tabletop provides a scenario‑based opportunity to evaluate response options for an AI‑enabled edge device compromise. Participants are challenged to recognize how deviations from normal device behavior can indicate serious risk and to assess those signals across multiple decision points.
The exercise emphasizes balancing decisive action with a clear understanding of exposure, vendor‑managed equipment, and the impact of response choices on preserving or destroying critical evidence.
Designed for cybersecurity professionals seeking to move beyond reactive troubleshooting, the course supports the development of investigative approaches aligned with security management and incident response best practices. It is particularly relevant for incident responders and security analysts who want to strengthen their ability to investigate anomalies and assess risk.
ISC2 Express Tabletops are part of a growing portfolio of flexible, practitioner‑focused training designed to help cybersecurity professionals build real‑world skills with confidence. Whether you’re sharpening investigative decision‑making or preparing your team to respond under pressure, these on‑demand experiences make it easy to train when and how you need. To explore Express Tabletops and the full range of ISC2 Professional Development offerings, visit https://www.isc2.org/professional-development.
