Standard tabletop exercises (TTXs) are a staple of security risk assessment and are, generally, useless. The same people read verbatim from the same IR/DR/BCP plans, half asleep, wondering how fast they can check this stupid box for their SOC 2 audit. Most of the time, neither the participants nor the facilitator want to be there, and no one comes away having learned anything except to call in sick the next time one is scheduled.