Why the payment decision gets skipped in rehearsal
It's legally, ethically, and organisationally uncomfortable, which makes it tempting to treat as "we'll deal with that if it happens" rather than rehearse explicitly. That discomfort doesn't go away during a real incident — it just gets compressed into a much shorter decision window with much higher stakes.
Organisations that have genuinely rehearsed this decision resolve it in under an hour during a real incident; organisations that haven't frequently take most of a day, during which the attacker's leverage only increases.
What a complete tabletop actually includes
Naming who holds decision authority, what legal and insurance counsel needs to be looped in and when, what the criteria for considering payment even are, and rehearsing the communication plan to staff, customers, and regulators simultaneously — not sequentially after the technical response concludes.
The technical response is the part everyone rehearses. The decision nobody wants to rehearse is the one that actually determines how bad the incident gets.MNB Security Practice
Key actions
- Name who holds payment decision authority before an incident, not during one
- Rehearse the payment decision explicitly in every tabletop exercise
- Loop in legal and insurance counsel as part of the rehearsed timeline
- Run communications and technical response rehearsal in parallel, not sequentially