Introducing Facilitator Mode: Run Instructor-Led Cyber Tabletop Exercises

Organizations kept asking us for a better way to run instructor-led tabletop drills. They wanted the group to experience the evolving scenario together on a big screen, while the facilitator directed the flow, triggered injects, and took notes behind the scenes.

Today, we're thrilled to launch Facilitator Mode—a new feature designed specifically for running synchronized, group-based cyber tabletop exercises.

The Problem with Traditional Tabletops

Usually, a tabletop exercise means someone clicking through a static slide deck. The "injects" are just bullet points on the next slide. If the group makes an unexpected decision, the facilitator has to verbally improvise the consequences because the slides can't adapt.

We built CyberWar24 to solve the static scenario problem using interactive, branching node graphs. But until now, our player was a single-player experience. If you wanted to run a group drill, everyone had to huddle around one laptop, or the facilitator had to awkwardly click through the UI while screen-sharing.

How Facilitator Mode Works

Facilitator Mode splits the experience into two synchronized views:

1. The Presentation View: A clean, read-only interface that the facilitator screen-shares (or puts on a projector). It shows the current story node, the live metrics, and the exercise timeline. It requires no login, so anyone with the link can watch.
2. The Control Panel: The facilitator's private dashboard. From here, the facilitator controls the pace of the exercise, selects the group's decisions, and monitors the background data.

Because the two views are synced in real-time using Server-Sent Events, the presentation view instantly updates the moment the facilitator advances the scenario.

Key Features for Facilitators

We've packed the Control Panel with tools specifically requested by incident response trainers and CISOs:

1. Pause & Discuss

A tabletop exercise is about the discussion, not just the destination. With one click, the facilitator can pause the exercise. The presentation view shows a "Paused for Discussion" overlay, letting the room know it's time to debate the current predicament without feeling rushed.

2. Live Injects

Sometimes a scenario needs a little extra chaos. Facilitators can now type ad-hoc "injects" directly into their control panel. These instantly appear as alert banners on the presentation view. Did the CEO just call? Did a journalist just leak the story? Type it in and watch the room react.

3. Private Notes

A great exercise identifies gaps in your incident response plan. Now, facilitators can jot down private notes tied to specific nodes as the exercise unfolds. These notes are never shown on the presentation view, but they are saved in the session history—making the post-exercise debrief and After-Action Report (AAR) much easier to write.

4. Group Decision Making

When a decision node is reached, the options appear on the presentation view for the group to read and debate. Once the room reaches a consensus, the facilitator selects that choice on their control panel, and the scenario branches accordingly.

Get Started

Facilitator Mode is available now for all users on the Professional and Enterprise tiers.

To try it out, head to the new Facilitator Dashboard, click "New Session," and select any scenario from your library. You'll get your two links immediately.

We can't wait to hear how this changes your next tabletop drill. If you have feedback or feature requests for Facilitator Mode, drop us a line!

Related Reading

• How to Run Your First Cyber Tabletop Exercise — end-to-end walkthrough for first-time facilitators.
• Crisis Management Team (CMT) Roles in a Tabletop — who should sit in the room when you run Facilitator Mode.
• MSSP Guide: Delivering Tabletop Exercises to Clients at Scale — how consultancies package instructor-led drills as a service.