Aaron Bond and Ruben Perales III of The Home Depot talk with Sean Martin about a Dungeons & Dragons-style tabletop where decisions have consequences. Listeners learn how it tests responders and surfaces undocumented gaps between teams.
Traditional incident response tabletops often check a compliance box without telling you much about the people who have to respond. What would it take to test the analysts and engineers themselves, and to do it more than once in a while?
Sean Martin talks with Aaron Bond, Cybersecurity Senior Manager - Defensive Security at The Home Depot, and Ruben Perales III, Incident Commander at The Home Depot, at ISC2 Security Congress in Denver. They had both taken part in traditional tabletops and wanted an iterative exercise that runs more often.
The conversation starts with the format. Bond says an analyst's decision has a consequence, good or bad, that reshapes the investigation, a goal he describes as making it somewhat like Dungeons & Dragons. Perales describes a session of about an hour with analysts, sometimes engineers, incident commanders and a game master, and an ending that is left open.
They then cover how an AI-built narrative earned management buy-in, since Bond says it cuts days, weeks or months of scenario writing to about an hour. They also discuss what the exercise surfaces: interactions with other teams that were needed but never documented. Perales says, "I feel like in every organization there are gaps between documentation and operation."
Bond explains how an in-house tool tracks timing, resolution and flags captured, which frees the game master to watch communication between teams. The episode closes with a look at a second session, a roundtable on how practitioners and leaders use AI in the security operations center, and Sean's point that it has to be done responsibly.
For security leaders, this is a practical look at testing people and process, not paperwork.
Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=tabletops-test-the-analysts-who-respond-not-the-compliance-box