AI & Agent Assurance
AI-Incident Tabletop Exercises
Your incident response plan assumes a human attacker and a human insider. We run realistic exercises around an agent that goes wrong — manipulated, compromised or simply mistaken — and test whether your people, process and controls hold.
The challenge
The first time you rehearse an AI incident should not be during one.
When an agent misbehaves, the questions come quickly. Which agent? What did it do, and to whom? Can we stop it without stopping the business? Who has authority to pull the plug? Do we have to tell the regulator, and by when?
Most organisations discover the answers during their first real incident — which is the most expensive way to learn them.
Our exercises are built around your environment and your agents, not a generic script. They test the Observation and Containment tollgates in practice: whether you can see what happened, stop it and explain it to your board within hours rather than weeks.
What you get
Outcomes, not reports.
- 01
Decisions rehearsed
Executives practise the calls that matter — shutting down an agent, notifying regulators and customers, and communicating publicly.
- 02
Gaps exposed safely
Missing logs, unclear ownership, absent kill switches and untested escalation paths surface in a room, not in production.
- 03
Playbooks that fit
Updated response procedures for AI-agent incidents, aligned to your existing incident and crisis frameworks.
- 04
Evidence of testing
A post-exercise report suitable for your risk committee, auditors and supervisors.
How we work
Senior-led from scoping to sign-off.
-
Design
We build a scenario around your real agents, data and dependencies — plausible, specific and uncomfortable in the right places.
-
Prepare
Participant briefings, injects and success criteria agreed with your exercise sponsor.
-
Run
A facilitated session with timed injects that escalate from technical anomaly to board-level crisis.
-
Debrief
Hot debrief on the day, followed by a written report with prioritised actions and playbook updates.
Deliverables
- Bespoke AI-incident scenario and inject pack
- Facilitated exercise (in person or remote)
- Post-exercise report with findings and actions
- Draft AI-incident playbook additions
Who it’s for
- Boards and executive committees who want to understand their role in an AI-related incident
- Security operations and incident response teams extending playbooks to cover agents
- Firms with operational resilience obligations that must evidence scenario testing
- Organisations about to scale agents into customer-facing or financially material processes
Aligned to
- NCSC incident management guidance
- UK operational resilience (PRA SS1/21, FCA PS21/3)
- DORA incident management and testing requirements
- EU AI Act serious-incident reporting
- ISO/IEC 27035
Questions
Frequently asked.
Who should take part?
It depends on the objective. Executive exercises involve the leadership team and key functions such as legal, communications and operations. Operational exercises involve security operations, IT, the agent’s product owners and platform teams. Many clients run both.
How technical is the executive version?
Not at all. The scenario is technically credible, but the executive session focuses on decisions, accountability and communication.
Often paired with
Agentic AI Security Assessment & Red Teaming
Adversarial testing of your agents and the tools they call — prompt injection, tool abuse, privilege escalation and exfiltration paths.
Explore Agentic AI Security Assessment & Red TeamingBoard AI Risk Briefing & Director Training
Separate AI as a threat, AI to govern and AI you use — so directors can challenge with confidence.
Explore Board AI Risk Briefing & Director TrainingvCISO for AI
A senior CISO on a retained basis, accountable to your board — with AI and agent risk built in from day one.
Explore vCISO for AIStart with a confidential conversation.
A confidential conversation about AI-Incident Tabletop Exercises with the senior practitioner who would lead the work. No sales team, no obligation.