Your CEO gets it. Your board gets it. From operations on up — everyone gets it. But how do you actualize the (known) importance of responding to a cyberattack efficiently and effectively, challenge the enterprise-wide assumption that “it will all work out,” and make IT security incidents real and remembered? For Derek Benz at BP, implementing top-notch tabletop sessions has inspired a waterfall of security initiatives from the C-suite, created more allies across the enterprise, and has, most importantly, helped middle-management better communicate and act in the “not if, but when” world.