Your organisation's worst year. Rehearsed in an hour.
A video-led tabletop exercise built from your own StackUp data and your own recent news. Four quarters, twelve decisions, five minutes each. Make the calls, see what they cost, and find out what your room actually decides.
The most valuable 60 minutes your board or leadership team will spend this year. Free to run.
Real screens · sample organisation
Try it now
Do not take our word for it. Take a decision.
This is decision two of the real exercise, lifted out of quarter one. Your head of IT has something. Watch the clip, then you have five minutes, the same as the room does. No sign-up, no email.
Situation
- A public link to an AI conversation contains an export of roughly 18,000 of your customer records, including names, emails and order history.
- You do not yet know who created it, when, or whether anyone else has opened it.
- Your data classification is rated Good; that is what decides how fast you can say what was in the file.
Decide
Your five minutes start when the clip endsDecision 2 of the real exercise · figures priced for a fictional 18,000-customer logistics company
In your own exercise this decision is written for your organisation, your data classification rating decides whether containment actually works, and what you choose here is still on the table in the fourth quarter.
The problem
Most boards and leadership teams have never rehearsed a bad day
They have read about one. They have approved a policy about one. Almost none have sat in the room while it happened and found out what they would actually decide, which is the only way to find out cheaply.
The expensive way to learn this is to live through it
A bad year teaches a leadership team exactly the same lessons the exercise does. It just charges hundreds of thousands of dollars for them, takes the better part of a year, and does the teaching in front of the regulator, the insurer and the press.
An hour in a room, with the same decisions and none of the consequences, is the cheapest version of that education anyone has found.
Oversight now has to be shown, not described
Regulators expect boards to test how the organisation operates through severe but plausible scenarios, and directors' duties apply to technology risk like any other. A tabletop is how you evidence that you looked.
AI incidents are the new tabletop
Every board has run, or been told to run, a cyber exercise. Very few have rehearsed a staff member pasting customer data into a public model, or a deepfake of the CEO approving a payment.
The consultant version takes a day
And costs tens of thousands, and is written for a generic company. Ours takes about an hour, is built from your own answers, and can be run again next quarter to see if anything changed. The cheapest version of this lesson is the one where nothing is actually on fire.
How it runs
Brief. Decide. Face the consequences. Debrief.
One room, one screen, one hour. Four quarters, twelve decisions, each with a video, a situation card written for your organisation, and five minutes for the room to decide.
Set it up, or put it in the diary
Pick your lens: board, executive team or CTO. Confirm six facts about your organisation, approve the news we found, then run it now or put it in the diary. StackUp sends the room a calendar invite in your name with a short pre-read attached.
The briefing
A short video sets the scene, addressed to your organisation: your size, your sector, the story that was in the news last month. The year ahead has four quarters, and your first decision is coming in.
Twelve decisions, four quarters
Each one is a 60-second video from someone inside the organisation, then a situation card written for you and five minutes on the clock. Your real posture decides what happens next, and what you decide in one quarter follows you into the next. If your backups are rated Poor, restoring from backup does not save you.
The debrief
Your Response Effectiveness Score, split into the decisions you made and the foundations you had. The running tally of cost, customers and complaints. The front page your year earned. The better decision at every step, the three factors that decided it, and the plan that fixes them.
The four incidents you work through
One per quarter, three decisions each. What you decide early carries into what comes later, the way it would in a real year.
A well-meaning manager pastes a customer export into a public AI tool to clean it up. Three days later a security researcher finds it. Then a journalist does.
Finance takes a video call from the CEO approving an urgent supplier change. The money moves on Friday afternoon. On Monday the real supplier calls.
Monday, 6am. Every screen shows the same note. The backup server is on the same network. The insurer wants a call before anyone touches anything.
Nothing new goes wrong. Everything you decided earlier in the year arrives at once, in front of the people entitled to ask about it.
Your own setup changes the outcome. Two organisations can make the same decision and get different results, because one has tested its backups and one has a policy nobody has read. Where we have had to assume something about you, the debrief says so.
What you walk out with
A score, a dollar figure, a headline, and the truth about why
All of it in the free debrief. The screens below are the product, captured as it renders, for a fictional organisation.
What the year cost, and what better decisions were worth
Three ranges on one scale: the path you took, the best path available from where you stood, and the worst. The gap between the first two is the number your CFO will ask about, and it is priced from your own facts, with every assumption named and editable.
The call you made, and the one that was available
Decision by decision: what the room chose, what happened, what it cost, and where a stronger option existed, what it was and the rule behind it. The decisions the clock made for you are marked, because in the room those are the ones people argue about afterwards.
The gaps that cost you, ranked by what they cost
Some of what goes wrong is not about the decisions at all. If your backups have never been tested, restoring from backup was never going to work, whoever was in the room. The debrief names each gap, shows what it cost on the day, and puts the worst one first, so you know what to fix before anything else.
The front page your decisions earned
Not a template with your name dropped in. It is written from the year the room actually had, quoting the moment it turned, with the share of customers who heard about it from someone other than you and how long trust takes to come back. It is the page people remember from the session.
Response Effectiveness Score
0 to 100 across containment, governance, communication, compliance and recovery, banded the same way as every StackUp score.
The financial ledger
Your path, the best path and the worst path, in your currency, with every assumption named and editable. The gap is what better decisions were worth.
The morning after
The headline your choices earned, a trust impact score, and how many customers heard about it from someone other than you.
What it means for your role
The three questions you will be asked, the decision you would want minuted, and what your insurer or auditor will now require.
What your customers experienced
How long service was down, what was exposed, what they were told and when, and what a reasonable customer now expects.
The factors that decided it
Named, rated, and traced to the assessment that measures each one. Where we had to assume, we say so, and show what an assessment would change.
Who it is for
Same bad year. Different seat.
You pick your seat at the start. Everyone gets the same incidents and the same decisions; the options are put to you in the language of the job you actually do, and the debrief closes with what it means for your role.
For the board
Options are framed as oversight calls: what the board asks management, what it approves, when it discloses, whether it calls the regulator.
Everyone works through the same incidents and the same twelve decisions. What changes is how the options are put to you, so the room argues about the call it would actually be making, not somebody else's.
The questions to put to management, the decision you would want minuted, and what your insurer and auditor will now expect to see.
Built from your data
Not a generic company. Yours.
Tailor the exercise with context about your organisation, or get started instantly.
What it costs
The exercise is free. The plan that fixes it is the paid part.
Reading about a tabletop exercise will not tell you how your team decides under pressure. An hour of actually doing one will.
The exercise and the debrief
- The full hour, with whoever you want in the room
- Your score out of 100, and how you got it
- What the year cost you, and how much of it was avoidable
- Every decision reviewed, with the stronger option where there was one
- The gaps that cost you most, worst first
The comprehensive action plan, and the watching
Eight to twelve actions that fix the factors behind your outcome, sequenced, with an owner, an effort band, a timeframe and the effect each has on your score and your ledger. One click puts them in your Action Planner. The factors behind them are tracked, so you know the moment your exposure changes, and a reminder brings you back in 90 days to see whether the outcome did.
- Sequenced actions with owners and timeframes
- Tracked in the Action Planner
- Factor monitoring through re-assessment
- Board-ready debrief PDF and pack
- Replay with a different lens
- Quarterly re-run and score history
For fractional CTOs and advisers
A better first meeting than a questionnaire
Run the tabletop with a prospect or a client from your own portfolio. They spend an hour discovering their gaps rather than an hour being told about them, and the debrief hands you a costed, evidenced case for the work you were going to recommend anyway.
- Run it for any client or prospect
- Share the debrief with the client in one click
- The action plan becomes your scope of work
- Re-run it a quarter later to show what changed
Portfolio access is part of the adviser plans. If you already have it, the tabletop is in your portfolio today.
Questions
Frequently asked
The rest of the platform
Five other things you can run
Each answers a different question. They all land in the same place.
Technology Assessment
The whole technology function, scored out of 100.
How it worksAI Maturity Assessment
Where you stand on the four questions boards ask about AI.
How it worksAI Leadership Skills
Whether your leaders could defend the AI strategy they set.
How it worksProject Assessment
A health score for one project, calculated not reported.
How it worksDiscovery Agents
Ask your team directly, rather than waiting for it to travel up.
How it worksRehearse the day you hope never comes
Run your first StackUp Tabletop free. A year in an hour, your data, your score. Or have us run it with your board.