Technology-Enhanced Tabletop Exercises for Cybersecurity Education: Lessons Learned

Source: arXiv:2607.28179 · Published 2026-07-30 · By Jan Vykopal, Pavel Čeleda, Martin Horák, Valdemar Švábenský

TL;DR

This paper addresses the underutilization of tabletop exercises (TTXs) in university cybersecurity education by introducing a technology-enhanced approach via the INJECT Exercise Platform (IXP). Traditional TTXs rely on pen-and-paper methods which limit scalability, realism, and automated assessment. The IXP platform automates scenario inject delivery, facilitates simulated tools (e.g., email clients, firewalls), collects rich interaction data, and supports data-driven evaluation. Between 2024 and 2026, the authors conducted 25 TTXs with 743 participants across university courses and extracurricular settings, observing increased student engagement, collaboration, and improved instructor visibility into team dynamics and decision-making.

The key novelty lies in combining structured, interactive digital TTXs with automated data collection and analytics, allowing tailored pacing per team and actionable insights post-exercise. The paper also presents 24 practical lessons learned, emphasizing design trade-offs, specification challenges, and best practices for integrating technology-enhanced TTXs in cybersecurity curricula. The empirical results demonstrate that digital TTXs offer a scalable, replicable model for experiential cybersecurity education, contrasting with the constraints of manual facilitation and paper-based formats.

Key findings

• 25 technology-enhanced TTXs were run from 2024 to 2026 involving 743 participants mainly from cybersecurity university courses and extracurricular events.
• Teams of size three yielded optimal engagement and diverse perspectives, while larger teams reduced individual participation.
• The INJECT Exercise Platform (IXP) automates scenario flow and inject delivery using milestone logic, enabling adaptive pacing per team rather than fixed timing.
• Automated collection of trainee actions, tool use logs, and milestone achievement allows near-real-time instructor visibility into team progress and supports data-driven assessment.
• Use of in-exercise tools (e.g., simulated email, firewall) increased trainee immersion and realism compared to discussion-only TTXs.
• AI-assisted evaluation of trainee responses can reduce instructor workload during assessments, while preserving qualitative judgment.
• On-demand, fully automated exercises scale well to hundreds of participants but limit flexibility due to the need for automatic evaluation of responses.
• Digital TTX design is complex; milestone logic formulation is the hardest part requiring iterative specification and preparation to avoid exercise stalls or freezes.

Threat model

The adversary is conceptualized as a simulated malicious actor generating cybersecurity incidents (e.g., phishing, ransomware) to which student teams must respond collaboratively. The adversary capabilities are embedded within scenario injects controlling events and data flow. The platform does not consider real-time adaptive or intelligent adversaries beyond scripted inject branching. It assumes no insider collusion or scenario disruption from participants. Human instructors oversee to prevent stalls or unanticipated trainee behaviors but cannot act as adversaries directly.

Methodology — deep read

The authors targeted cybersecurity education settings involving undergraduate computer engineering and information studies students, as well as high school participants in some cases. The threat model addresses preparing defenders (students) for coordinated incident response, emphasizing team communication and decision-making under uncertain scenarios. Adversarial behavior is simulated via scenario injects (e.g., phishing emails), but offensive red-teaming is not included.

Data arises from 25 TTX exercises conducted between October 2024 and March 2026 using versions 1 to 5 of the open-source INJECT Exercise Platform (IXP). The sample comprises 743 trainees performing 21 distinct exercises tailored to target audiences. Exercises vary in format: discussion-based, simulation with interactive tools, synchronous or on-demand delivery.

The platform ingests YAML scenario descriptions specifying narrative injects, conditional milestone triggers, and tool simulation behaviors. This enables branching scenarios and adaptive flow. Milestones track achievements of learning objectives. Exercises include simulated email clients, web browsers, firewalls, and document repositories allowing trainees to act realistically.

Preparation follows a five-phase INJECT Process: Understanding (defining needs and audience); Specification (converting objectives into scenario logic and milestone conditions); Preparation (authoring YAML or using the visual editor, testing exercises); Execution (running synchronous or on-demand TTXs with instructor facilitation and monitoring using a real-time dashboard); Reflection (post-exercise review using collected logs and trainee feedback).

Trainee interactions, tool usage, milestone progress, and communication data are logged automatically. Instructors can view team progress live and intervene with pre-set email templates or free-form responses to support teams. Evaluations are done during or after the exercises, with recent exploration of AI-assisted scoring to reduce instructor load.

Evaluation metrics include observed team engagement, milestone achievement timing, communication patterns, and post-exercise questionnaires. The authors analyze instructor focus group discussions and questionnaire feedback to derive lessons learned. No formal adversarial testing or control group comparisons are reported. Exercises stress iterative development to balance narrative coherence, milestone logic, and learning objectives alignment.

For example, a ransomware incident response TTX involves milestone triggers upon investigation steps, simulated firewall blocking IP addresses, and email exchanges. The platform automatically releases injects upon milestone conditions, and instructors assess trainees’ situation reports submitted via the platform email. This allows detailed path tracing of each team’s incident response process and instructor facilitation tailored to team status.

Code and platform are open-source, enabling reproducibility, but datasets containing student interaction logs are not publicly shared due to privacy. The paper details progressive platform enhancements from prototype to stable v5 supporting 100 concurrent teams, multi-tenancy, and integrated analytics dashboards.

Technical innovations

• INJECT Exercise Platform (IXP) uses milestone logic to adapt scenario inject delivery dynamically per team rather than relying on fixed timing.
• Integration of simulated real-world tools (email client, firewall, web browser) within TTX to increase realism and interactivity.
• Automated logging of granular trainee actions and milestone achievements enables near-real-time instructor monitoring and data-driven assessment.
• Development of a web-based exercise editor and Visual Studio Code extension to simplify YAML-based scenario authoring for non-experts.

Datasets

• 25 TTX exercises from 2024 to 2026 — 743 participants — university courses and extracurricular events

Baselines vs proposed

• Pen-and-paper TTX: manual inject delivery, limited data capture, higher instructor workload vs IXP: automated injects, detailed activity logging, reduced workload
• Discussion-only TTX: lower immersion vs simulation-based IXP TTXs with in-exercise tools: higher trainee engagement and realism
• Manual instructor evaluation without AI-assistance: longer evaluation time vs AI-assisted evaluation: reduced instructor time while maintaining assessment quality

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.28179.

Fig 2: Screenshot of the Editor in IXP depicting a part of the exercise with a learning activity with three injects connected through two milestones.

Fig 3: Screenshot of email templates for answering trainees’ mails in a TTX.

Fig 4: Real-time view showing the achievement of learning objectives and

Fig 5: Analyst view showing team milestones grouped into three clusters

Fig 6: Analyst view showing a graph of selected exercise events for a team. Activating the left milestone triggered an inject and tool access. Tool use then

Limitations

• No formal adversarial evaluation involving real attackers or red teams to test TTX robustness under active threats.
• Lack of controlled experiments comparing technology-enhanced TTXs against traditional TTXs with objective performance metrics.
• Participant sample skewed primarily toward cybersecurity students with limited diversity in roles and industries.
• Exercises predominantly focus on incident response scenarios, limiting generalizability to other cybersecurity domains.
• AI-assisted evaluation is in early stages and results on accuracy and bias have not been thoroughly reported.
• Iterative design process requires substantial upfront effort; novice designers face steep learning curve with YAML and milestone logic.

Open questions / follow-ons

• How to quantitatively measure learning efficacy of technology-enhanced TTXs versus traditional formats under controlled studies?
• Can AI techniques fully automate trainee response evaluation without loss of qualitative nuance in complex incident scenarios?
• What adaptations are needed for TTXs to support diverse cybersecurity domains beyond incident response, such as offensive security or policy making?
• How to scale synchronous instructor involvement efficiently for large participant cohorts in interactive TTXs without sacrificing engagement?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, this work offers valuable insights into designing interactive, team-based simulation exercises that enhance operational readiness and decision-making under pressure. The INJECT Exercise Platform’s approach to adaptive scenario progression, automated inject delivery, and integrated analytics could inspire tools for training and evaluating security teams on detection and response workflows relevant to bot attacks and abuse mitigation. Data-driven assessment techniques and milestone-based pacing may also inform evaluation strategies for user engagement or challenge difficulty calibration.

While the paper primarily focuses on cybersecurity incident response education, the underlying principles of technology-enhanced tabletop exercises—such as realism via simulated tools and scalable automated scaffolding—are broadly applicable to bot-defense contexts requiring multi-actor coordination. However, practitioners should be mindful of the significant upfront effort and design complexity the authors report when developing effective TTX scenarios for their specific threat models and user bases.

Cite

@article{arxiv2607_28179,
  title={ Technology-Enhanced Tabletop Exercises for Cybersecurity Education: Lessons Learned },
  author={ Jan Vykopal and Pavel Čeleda and Martin Horák and Valdemar Švábenský },
  journal={arXiv preprint arXiv:2607.28179},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.28179}
}

Read the full paper

• arXiv:2607.28179 (abstract)
• arXiv:2607.28179 (PDF)