Blog
The day-after file is not the tabletop
At 14:22 Dana drafts a holding statement for a reporter. The file calls it a catastrophic cyber exercise. In March an assessor asks who isolated prod-payments-01. How to keep that rehearsal from standing in for the tabletop.
At 14:22 on 9 October 2026, Dana K (legal) is in a conference room with Marcus T (incident commander) and Sam O (communications). The facilitator reads an inject: a reporter asks whether Northwind's model took card-processor-02 offline overnight. By 15:06 Dana has a four-sentence holding statement on paper. Marcus says it does not go out. The file saved at 16:40 says the executive preparedness exercise on a catastrophic cyber scenario is complete.
In March an assessor samples that file as the incident-response exercise for the period and asks who isolated prod-payments-01 when the EDR flagged encryption. The room on 9 October never had a host. The afternoon produced a real decision, and the file stored it under a name that answers a different question.
A weak record of that afternoon reads:
Executive preparedness exercise. Catastrophic cyber scenario. Team discussed public response. Complete.
A strong one reads:
9 October 2026, 14:00 to 15:30. Day-after rehearsal. Seats: Dana K (legal), Marcus T (incident commander), Sam O (communications). Priya S (on-call, infra) was not invited. Inject at 14:22: a reporter asks whether Northwind's model took card-processor-02 offline. Dana drafted a four-sentence holding statement by 15:06. Marcus decided it does not go out. No host was named. No customer list was pulled. No regulator portal was opened.
Both afternoons happened. Only the second tells a reader in March what was decided, and what was never on the table. The first costs you the period. The only executive sitting you ran gets attached to the questionnaire row for the incident-response exercise, and you still have no record of who isolates prod-payments-01.
What the 9 October report actually describes
The same day, Axios reporter Maria Curi wrote that executives at OpenAI, Anthropic, and other AI companies are privately working through a public and political reaction after a catastrophic AI event, most likely a cyberattack that cuts off financial services, connectivity, or power and water. The planning she describes works through worst-case scenarios and focuses mainly on educating members of Congress, so the companies have a hand in the rules people reach for after a first event. OpenAI told Axios it runs preparedness exercises in which teams discuss scenarios, and that those scenarios are not treated as inevitable. Anthropic declined to comment. Many people Axios spoke to said they expect a major event in the next six to twelve months.
That window is what those sources expect. It is not a date, and it is not a finding from an exercise. Axios does not describe an incident-response tabletop, and it does not publish a packet. OpenAI's line is that teams discuss scenarios. If you book the same hour and save it as the incident-response exercise, your reader has the problem this report leaves its reader with. They cannot tell which decision was practiced.
Put the instrument in the first line
The first line of the file names the sitting. Day-after rehearsal, or incident-response tabletop. A first line that says preparedness exercise, or catastrophic cyber scenario, names a topic. A topic can hide either afternoon.
A day-after rehearsal can be about a reporter, a holding statement, and who may say the product stays up. An incident-response tabletop is about a named system, a clock, and a person who can act on it. Which instrument answers which question is the earlier booking decision, in when not to run a tabletop. This post is the line you write after you have already sat down, so the two files cannot be swapped later.
Give the host its own file
A reporter question can be one inject inside the incident sitting. The injects post already puts one there: at T+50, Sam says what is known, what is unknown, and what is under investigation, or the room stays silent. That decision belongs in the same file as the isolate, because the host is still the subject.
The 9 October afternoon is a different instrument. Nobody named a host. Priya was not in the room. The only artifact was a holding statement Marcus refused to send. Adding "and then we would isolate the database" in the last ten minutes does not make it the tabletop. The room has not isolated anything. It has agreed on a sentence it might say later.
Run the host on its own day, with the people who would touch it:
16 October 2026, 09:00 to 10:30. Incident-response tabletop. Inject at 09:14: EDR on prod-payments-01 flags that pay-auth has been encrypting the settlement directory, 400 MB since 09:11, host still taking authorizations. Priya S isolates prod-payments-01 at 09:19. Wei L is asked for the last clean backup of the standby processor before anyone fails card authorization over. Wei cannot name it by 09:30. Failover is held. Dana K is not in the room, so the customer notice is not drafted. Follow-up: Wei names the backup, or writes that nobody owns it, by 23 October 2026.
The customer notice, drafted and not sent, stays in this sitting. That clock is its own practice, in the customer-notice post. It is a different letter from the holding statement Dana wrote for the reporter on 9 October. A press line and a customer letter answer different people. A packet that stores one of them under the other's name will be read as both.
Point the questionnaire at the tabletop
When a questionnaire asks for the incident-response exercise in the period, the index row should point at the 16 October file, with the date, the owner, and what the sitting was. A second row can point at the 9 October rehearsal as a public-statement sitting. One row labeled cyber exercise, October, will get the day-after file attached, because that file is shorter and already says complete.
Write the tabletop in the free evidence template: attendance, including Priya's absence on 9 October and Dana's absence on 16 October, the timed decisions, and the gap Wei still owns. Put both files in the evidence index as separate rows, with the date and the owner on each, so the next questionnaire is a lookup. For the host sitting, hang the 09:14 inject on a ransomware family in the scenario library. The AI incident family there is a cross-tenant disclosure by an in-product assistant. That is a different decision from a reporter asking whether a model took a processor offline. Write the reporter sitting up yourself.
The 9 October file shows that Dana, Marcus, and Sam held a holding statement at 15:06. It does not show that anyone can isolate prod-payments-01. The 16 October record is where that decision goes, or where you write that the seat was empty.
Bottom line: name the sitting in the first line, and keep the reporter's afternoon and the host in different files. A preparedness exercise is a topic. The packet has to say which decision the room actually made.