Matt Hartley, co-founder and Chief Product Officer of BreachRx, on why the once-a-year tabletop no longer matches the incidents organizations will actually face, and how AI-accelerated micro tabletops let teams train like they fight.
In this episode I sit down with Matt Hartley, co-founder and Chief Product Officer of BreachRx. Matt has spent 28 years in cybersecurity. He started in government offensive security, then moved to the cyber threat intel startup iSight Partners, where he ran product through its acquisition by FireEye, and later ran Mandiant Engineering. He watched consulting teams parachute into companies that were compromised and meaningfully unprepared, and that convinced him the real gap was the response process, not detection or tooling.
We get into what a micro tabletop actually looks like and why exercises should run in the same system you will use during a real incident. We also cover how notification clocks as short as 30 minutes change what legal teams need to practice, and why the floor is shifting toward multiple concurrent incidents.
In this episode:
● Why the industry over-invests in technology and under-invests in the processes and procedures that carry a response
● What a micro tabletop looks like, from a one-hour cross-functional session to an exercise that runs asynchronously over a week with a 30-minute hot wash
● Train like you fight, and why rehearsing in your actual response platform lowers stress and folds lessons learned back into procedures
● More than 200 laws with incident notification requirements, including China's 30-minute window and India's six-hour rule covering even denial of service
● Starting a legal tabletop partway into a ransomware scenario to pressure test DORA, SEC, and other regulatory timelines
● Why privileging everything means nothing is privileged, and separating the factual record from privileged conversations
● The risk of 10 to 100 Slack or Teams channels spinning up around a single incident, and how one grouchy message can end up in evidence
● Keeping exercises from becoming check-the-box by matching frequency to team size and threat, pulling scenarios from the headlines, and running two incidents at once
● Why AI is raising the attack floor, from smarter background malicious traffic to lower-tier nation states making big capability jumps
● A workforce of AI agents that cuts incident reporting from 20 hours to 30 minutes and turns NIST, CISA, or Gartner guidance into tailored procedures
● A crawl, walk, run playbook for your first micro tabletop: three injects, one ornery stakeholder relationship, and a ten-minute debrief
● What regulators and plaintiffs will ask for, and why the SEC may look at five years of incidents, not just one
Chapters:
0:00 – Intro
1:42 – Matt's Path from Offensive Security to Mandiant
2:14 – Why Response, Not Detection, Was the Real Problem
3:40 – What a Micro Tabletop Actually Looks Like
7:37 – Train Like You Fight in the Real Platform
9:33 – Regulatory Clocks, DORA, SEC, and 30-Minute Notifications
11:56 – Privilege, Discoverability, and the 100 Slack Channel Problem
15:03 – Keeping Exercises from Becoming Check-the-Box
17:48 – Concurrent Incidents and a Rising Attack Floor
19:53 – Where AI Agents Fit in Incident Response
22:01 – Running Your First Micro Tabletop Next Month
24:12 – Proving Continuous Readiness to Regulators and Plaintiffs
26:55 – Closing
Connect with Matt Hartley:
LinkedIn: https://www.linkedin.com/in/wmhartl/
BreachRx: https://www.breachrx.com
BreachRx IR Exercises: https://www.breachrx.com/rex-platform/incident-response-exercises/
Read my piece on BreachRx and incident response, Chaos, Clocks, and
Command Centers: https://www.resilientcyber.io/p/chaos-clocks-and-command-centers
Resilient Cyber: https://www.resilientcyber.io
Subscribe for more conversations with security practitioners and leaders.
#incidentresponse #tabletopexercise #aisecurity #ciso #cyberresilience #securityleadership
27 mins