At ISC2 Security Congress in Denver, two defenders from The Home Depot describe a tabletop exercise built to test the people who respond to incidents, not the paperwork around them. Aaron Bond, Cybersecurity Senior Manager - Defensive Security, and Ruben Perales III, Incident Commander, talk with Sean Martin about how each decision a player makes changes what happens next.
From compliance box to testing the responders
Bond says the team had been part of a lot of traditional tabletops that check a box for compliance on whether the incident response process works. The question that followed was how to do more than a scripted narrative that looks for predefined answers to a scenario.
Perales came to the exercise as a participant who thought it could be done better. A traditional session, he says, is a lecture on rails with no real room for choice, and the team wanted players to learn in a fun, interactive way, so they leave with something instead of spending an hour or two and not remembering what happened.
Bond says the goal was an iterative process that happens more often and tests the actual responders, not the business and its response process in the abstract. Sean's reaction was that this puts the human element back in.
Every decision has a consequence
Bond says real incidents do not allow a player to make a mistake, talk about it, and move on. So in the team's process, if an analyst makes a decision, the decision has a consequence, good or bad, and that consequence reshapes the investigation from there. Sean described it as choose your own adventure, and Bond says the aim was to make it somewhat like Dungeons & Dragons.
Perales describes how a session runs. It lasts about an hour, and it can be extended depending on the timeframe. The table includes analysts, sometimes engineers, incident commanders, and a game master who runs the tabletop. The ending is left open. Players are encouraged to decide, and a decision may turn out to be an inappropriate action that factors in later in the game.
Much of the exercise is dialogue between team members, so one team may progress further than another. The readout then compares them: how quickly a team finished, or which flags it did not capture. Perales adds that the team wanted the exercise to be bespoke, tailored to the organization and using only tools the team typically uses, so it does not feel generic.
An AI-built narrative won over management
Sean asked how the team got management behind the investment. Bond says buy-in was limited when the work started, around the time large language models were becoming more popular, so the first exercises had to be generic. As with any language model, he says, a generic prompt gets a generic response, and the team could only add the context that makes events realistic and applicable to the organization later.
What showed value immediately, Bond says, was having AI build the narrative. Writing a tabletop narrative by hand takes days, weeks, if not months, and getting one in an hour or so was "a huge win for us." As the work progressed, he says, nobody questioned whether it was worth the time.
Perales adds that doing something completely new means trial and error: whether a piece makes sense in the game, how much time to put into it, and how many people would like it. Coding with AI, he says, is itself still evolving.
What falls out when the game is played
Sean asked whether the tabletops led to changes in how the security operations center (SOC) works. Bond says the biggest early finding was interactions and engagements with other teams that the scenario needed but that nobody had documented.
Bond ties that to how knowledge moves. In a remote workforce, or even a team sitting together in a physical SOC, he says people struggle to share knowledge, so each person builds a baseline and an understanding of how a process works outside what is documented. What the team identified early was an engagement and interaction model with other teams that needed to be defined better.
Perales puts the general case in a sentence:
He says that when you run tabletops, "all that falls out," and you get to see how well the process works.
A tool keeps score so the game master can watch
A traditional exercise needs a scribe to track notes, documentation and metrics, and the game master has to keep up with all of it. Bond says an in-house tool now tracks timing, resolution, flags captured and inappropriate actions, which frees the game master to watch communication. That means looking for whether someone is keeping information siloed, whether one person is deciding instead of the team, and whether there is a communication gap between two teams.
Sean asked how involved the game master is. Perales says it is Jeopardy style: after the players talk and reach a solution, the game master asks whether it is their final answer, and someone may say yes or decide to try something else. He calls the role purely observational, a spectator who no longer has to run the metrics. Bond says the tracked data helps the team reshape and define training for its teams.
Next: a roundtable on AI in the SOC
Bond describes the team's second session at the Congress as a roundtable, not a presentation. It brings a group of practitioners and leaders together to work on problems they may not have answers to yet. He says the team has done a lot to build AI into its SOC processes, in response, threat hunting and the tabletop process, and he points to quality assurance as one key area, where the goal is to free analysts from spending so much time on QA and alerts.
The conversation for that session is about how people use AI in the SOC today, what problems they are solving, and how the group can help solve more. Sean said it has to be done responsibly, since AI raises the question of where it connects and what data is in it, and Bond and Perales agree. Readers who want the tabletop detail can hear it from both of them in the full conversation.
Questions answered in this article
What did Home Depot's Aaron Bond say is wrong with traditional tabletop exercises?
Bond says traditional tabletops check a compliance box on whether the incident response process works, so the team wanted an exercise that tests the analysts and engineers who respond. Read more: From compliance box to testing the responders
How long does Ruben Perales III say the tabletop session runs, and who takes part?
Perales says it is typically about an hour, and can be extended depending on the timeframe. It includes analysts, sometimes engineers, incident commanders and a game master, and the ending is left open. Read more: Every decision has a consequence
How did the team win management buy-in for AI-built tabletops?
Bond says AI building the narrative showed value almost immediately, since doing it by hand takes days, weeks, if not months, against about an hour with AI. Read more: An AI-built narrative won over management
What did the tabletops reveal about how teams work together?
Bond says the biggest early finding was interactions with other teams that the scenario needed but nobody had documented. Perales says gaps between documentation and operation fall out in tabletops. Read more: What falls out when the game is played
What does the in-house tool track during a tabletop exercise?
Bond says it tracks timing, resolution, flags captured and inappropriate actions, work a scribe would otherwise do, which frees the game master to watch communication. Read more: A tool keeps score so the game master can watch
What does the game master do during the exercise?
Perales says the game master confirms a team's final answer in a Jeopardy style and is purely observational, watching communication such as siloed information and gaps between teams. Read more: A tool keeps score so the game master can watch
What is the second Home Depot session on AI in the SOC about?
Bond describes it as a roundtable where practitioners and leaders discuss how they use AI in the security operations center today, including response, threat hunting, tabletops and quality assurance. Read more: Next: a roundtable on AI in the SOC
For all of the content in this series, have a look at the main series post: Sean Martin is Live from ISC2 Security Congress 2026.
Read the full transcript · 3,190 words
Aaron Bond and Ruben Perales - Edited MC
Sean Martin: So it's kind of like, choose your own adventure, whether you like it or not.
Aaron Bond: Exactly. I I think when we were, when we were defining this, our, our goals were to. Make it somewhat like Dungeons & Dragons.
Sean Martin: We're in Denver.
Aaron Bond: Yes, we are. Yeah,
Sean Martin: we're in Denver. I have to remind myself where I'm, I feel like we're high up in the sky.
Aaron Bond: Beautiful weather though. Yeah,
Sean Martin: it is beautiful today.
Aaron Bond: Mm-hmm.
Sean Martin: There's a spot out back. I don't know if you guys see there's like a big mound.
Aaron Bond: Yeah.
Sean Martin: And you can see the. I was joking. I said, you can see the Smoky Mountains over there.
Aaron Bond: I mean, that's me. You know? So
Sean Martin: I know,
Aaron Bond: I hear you.
Sean Martin: I was my co-founder and I, Marco, we, we always go, like, we're in London and we say, oh, there's the, uh, there's the Bridge of Venice or something.
Aaron Bond: Yeah.
Sean Martin: They're always messing with people. Anyway, we're not here to talk about bridges or mountains or any mountain ranges. we're here to talk about tabletops.
Ruben Perales III: Mm-hmm. Yeah.
Sean Martin: So, which are mountains as well. But, uh, um, so you guys. Had, well, I think you had two sessions here. I don't know, were you part of both sessions?
Ruben Perales III: Uh, just one. Just one.
Sean Martin: Just all right. Mm-hmm. Um, looking at the soc, [00:01:00] looking at ai of course, and tabletop exercises, we're gonna focus on the tabletop stuff, but maybe you can give a little brief overview of what you did with AI and the SOC too. Yeah. When we get to there. Mm-hmm. Um, quickly, a few words from each of you, Aaron. We'll start with you, kind of your background and what's going on.
Aaron Bond: Yeah. So, uh, I'm Aaron Bond. I am, uh, the senior manager of cyber Defense Operations for The Home Depot. And, um, yeah, my background really stems from, um, you know, technology in the military, specifically the Navy, and then transitioning out into, um, cybersecurity when I love the military, And, uh, ever since I've been SOC focused on building SOC, um, you know, finding new technologies to help enable SOC and, and, um, operations within the SOC. So, yeah,
Sean Martin: Very cool. Ruben.
Ruben Perales III: Yeah. So, um, uh, I'm Ruben. I'm the Incident Commander for The Home Depot. Uh, I've, you know, 10 plus years of experience, uh, within security. I've been in retail, I've been in hospitality, and I've been in the gaming sector, so,
Sean Martin: wow. Lots of different experiences.
Ruben Perales III: Lots
Sean Martin: of private public sector coming together.
Ruben Perales III: Mm-hmm.
Sean Martin: And have you worked with a mutual friend
Ruben Perales III: Yes.
Sean Martin: There in Vegas at one point. Mm-hmm. That's very Mari Galloway. So, um, alright, so let, let's talk about the catalyst two, two catalysts, one. To do the tabletop exercises and then kind of what brought you to actually submit a, a talk at ISC2 Security Congress?
Aaron Bond: Yeah.
Sean Martin: Mm-hmm. So maybe that background story.
Aaron Bond: Yeah, I think I can kick it off and I'm sure Ruben has some thoughts too, but um, you know, we've been a part of a lot of just traditional type tabletops where you're coming in and you're really checking a box for compliance around, you know, does your incident response process work? It. And, uh, you know, we thought, you know, how can we take this to the next level? How can we do more with testing and tabletop exercises beyond just a scripted narrative that looks for predefined answers to a, to a problem or to a, to an inject or scenario? Um, and that's really kind of where we took, uh, tabletops, is, uh, we wanted to make this like an iterative process that happens more often, uh, that we can test, uh, not. The business per se, and the response, but the actual responders, the analysts and the engineers,
Sean Martin: the human element of it.
Ruben Perales III: Mm-hmm.
Sean Martin: Fancy that.
Ruben Perales III: Yeah.
Aaron Bond: Yeah. So, so that's really where we wanted to take it. Uh, and we wanted to move beyond just that scripted narrative of, uh, you know, inject X scenario. And I'm expecting to get why we wanted to make it as real world as possible. You know, in, in cyber during an incident, you can't. Uh, make a mistake, talk about it, it'd be okay, and then move on. Uh, that's not how incidents work. So, uh, our tabletop process evolved into something where, uh, if an analyst makes, uh, a decision, their decision has a consequence, good or bad, and based on the off of that consequence, it, uh, reshapes the investigation moving forward.
Sean Martin: So it's kind of like, choose your own adventure, whether you like it or not.
Aaron Bond: Exactly. I I think when we were, when we were defining this, our, our goals were to. Make it somewhat like Dungeons & Dragons. Yeah. Mm-hmm. Uh, and choose your own adventure. So, yeah.
Sean Martin: Very cool.
Ruben Perales III: Yeah. Well, I would say just the, uh, the evolution of it really was being a participant in the exercise and saying, Hey, we can do this better. You know, instead of it being a traditional lecture on rails, there's no, uh, there's no real ram of choice. Uh, we wanted to incorporate that into the game and allow the players to be able to learn in a fun, interactive way. to where they're actually stepping away with something. It's not, you know, I spent one, two hours in a session and I don't remember what happened.
Sean Martin: Right.
Ruben Perales III: Yeah.
Sean Martin: So describe, paint a picture of the, of the exercise. Is it one two hour session? Is it a full day, is it many days?
Ruben Perales III: So, uh, yeah, it's, um, it's about an hour session. Um, depending on the timeframe ride, we could extend it. We could not. But typically it is an hour and it is a, multitude of people. So we have analysts. Uh, sometimes in engineers we have the, uh, incident commanders, and then we have the game master who is running the, uh, the tabletop. So very Dungeons & Dragons type where you're getting everyone to participate.
Sean Martin: Okay?
Ruben Perales III: Mm-hmm.
Sean Martin: and so you said you have the, the injecting, you expect the resolution or Some, some closure at the end. Is that my, my thought of a, the next or playbook or a tabletop would be. You start here and, and we expect you to land here.
Ruben Perales III: Yeah.
Sean Martin: Um, do you leave that open because you said choose your intervention. You might not end up there, but do you
Ruben Perales III: Yes.
Sean Martin: Or is it, you always have to find your path back to there.
Ruben Perales III: So, so we leave it open. Um, of course we, uh, we encourage, uh, decision making and what that decision making you may make inappropriate actions, which could factor in later in the game. And then two. A lot of it is dialogue between these team members. So depending on the team, you know, you may not progress further than the other team. And then that comes in readout where it says, Hey, you know what? Team one, you finished the exercise this quick. or maybe team two, you know, it took you longer or maybe you didn't achieve all the flags you could have gotten. So there's that, that type of dynamic.
Sean Martin: Okay.
Aaron Bond: Yeah. Because of the process and how we've built this out, we, uh, we're able to track metrics, timing, um, resolution, flags captured, um, inappropriate action. things like that along the way that help us, you know, uh, reshape and, and like define training moving forward for our teams.
Sean Martin: And I presume you use a lot of the same tools as you would in, in real life, or what does that look like? Oh,
Ruben Perales III: yes, yes.
Sean Martin: So you're actually, it's simulating reality, right?
Ruben Perales III: Yes. And that was a, that was a big portion of it at the beginning was that uh, we want to make it as bespoke as possible. Uh, tailored to our organization so that it's not generic. We're not using any tools that we don't typically use it. It just makes sense.
Sean Martin: Right. [00:07:00] So what were some of the, maybe this goes into the session now, or some of the things you presented as obstacles, bumps in the road, lessons learned. I don't even wanna share a few of those.
Aaron Bond: Yeah, I think the evolution, um, kind of speaks to the bumps in the road, right. Um, we started looking at this early on when, uh, LLMs were kind of becoming more and more popular. Uh, but, you know, we didn't exactly have enough buy-in, so we had to start with very. Generic type exercises, just like with any LLM that you use, if you give a generic prompt, you're gonna get a generic response. Um, and it wasn't until later that we could provide more context for our events to make them realistic and and applicable to the organization. Um, so I'd say that that's, you know, obstacles along the way, just buy in from the company. Um, and, uh, the use of ai,
Ruben Perales III: I guess I would say to that. Uh, when you're doing something completely new, right? It's, it's kind of trial and error. It's like, Hey, you know, does this make sense in the game? Do we need this Do we not need it? Um, how much time should we put into the game? Right? Uh, 'cause right at the beginning, we didn't know how big it would be. we didn't know how many people would like it. So a lot of those factors came into it. And then coding with ai, you know, that's, that's a evolving thing, so, yeah.
Sean Martin: Right.
Ruben Perales III: Mm-hmm.
Sean Martin: Yeah. As it, as I dig into it more, I've had a few conversations this week. The more I do, the more I learn.
Ruben Perales III: Mm-hmm.
Sean Martin: And I have a feeling that the system's learning from me as well, so it's picking up on how I interact with it to hopefully please me. Right. I mean, that's what, it's, the objective is to please me at the next, next thing it's working on. Yeah.
Aaron Bond: It's gotta make you happy. Right.
Sean Martin: It gotta make me happy. Um. In that spirit of, of innovation and, and taking on new challenges and, and exploring and experimenting, um, how did you get executive team buy-in or management buy-in to, to say, this is an investment we're gonna make with the team, and some, some tokens and some, mm-hmm.
Aaron Bond: Yeah. I, I think, um, just the, the being able to use AI to build the narrative by itself early on, um, even if it was generic and it wasn't exactly. tailored to the organization, um, it showed value almost immediately, right? You think about building a narrative for a tabletop, and you're talking days, weeks, if not months, where you're defining the narrative based around a scenario or an idea that you have. Uh, and it's just a huge time sink, right? and um, and you know, we talk a lot about being able to use what's available to us to speed up processes, make things easier for us. And so just the early capability of define or building the narrative in an hour or so versus days and months, right? um, was a huge win for us. And so as we progressed it along the way, I don't think there was a question on, you know, is this beneficial? Uh, should we be, should we spend time on this? It was just obvious. So,
Sean Martin: and my experience, sadly, I wish I had been sitting in a SOC. I haven't sat in a SOC, but, um, I get to talk to a lot of people who, who have and do. And where was I going with that? Um, the tabletops can often lead to improvements in the operations themselves, right. The team learning is one for sure, but perhaps a change in how you do things in the SOC. Did you uncover anything like that? Not specifics. Yeah. Like we, we swap out this tool, but just kind of big picture.
Aaron Bond: Yeah. I'll let Ruben go here in a second. But I think some of the, the biggest things early on that we found were probably interactions and engagements with other teams. Mm-hmm. uh, that were needed based on the scenario that we just didn't have documented. Uh, you know, when you're, when you're working with a remote workforce or even a workforce that's in this, in the physical SOC together, what you struggle with are, uh, people sharing knowledge. and so people start to build their own baseline and their own understanding of how a process works outside of what's documented. And uh, so that's what we identified early on was that engagement and interaction model with the other teams that we needed to define better.
Ruben Perales III: Mm-hmm. And, uh, I guess just to tack onto that, yeah. There, um, I feel like in every organization there are gaps between documentation and operation. And when you're doing the tabletops, all that falls out. and, uh, and you get to see how, how, how well it works out. Right, right. Yeah.
Sean Martin: Get to your, your teammates taking that journey with you. Mm-hmm.
Ruben Perales III: Um.
Sean Martin: Uh, how about communications? that's another area that obviously the different teams mm-hmm. Have to communicate. Um, different language and security, maybe even detection, protection or, yeah. Protections are one and network and endpoint of different and get in the SOC different language, phone management, different language. Certainly move out into different parts of the bus business, different language. How does, how does the tabletop experience help? With all of that,
Aaron Bond: uh, [00:12:00] this, this is where our tabletop experience helps. Yeah. Mm-hmm. So, traditionally we'll use Game Master and keep with the same lingo. Um, the Game Master has to follow along with keeping track of notes and documentation and and metrics. Um, our process has freed them up from that So the, the tool that we've developed in-house, um, and the, the ability for game masters and analysts and engineers to interact with it keeps track of a lot of that. Um, a lot of those metrics and things that a normal, like traditional exercise would, would need a scribe or somebody to keep track of. Um, and it frees up that game master to keep an eye on communication. Ah, so as somebody keeping information siloed, is one person making the decision versus the team, um, is there a communication gap between two different teams? that's that's where we freed up the game master to focus more time on it versus. This action was taken at in 32 minutes and you know that's already done for 'em.
Sean Martin: How involved is the game master in the game? Do they say, Hey, [00:13:00] do you really wanna do that? Or do they just kind of sit back and watch?
Ruben Perales III: So it's very, it's very, uh, jeopardy style where it says, Hey, um, you guys had a dialogue. you guys came to a a solution. Is that your final? Is that your final option? And then someone can say yes, someone can say, ah, you know what, actually may, maybe not. Okay, maybe we should do something else.
Sean Martin: So they try to keep the judging, uh, tone out of it, or,
Ruben Perales III: yeah. No, they, the, it's
Sean Martin: purely,
Ruben Perales III: purely a spectator, uh, purely observational. Okay. Like I said, we freed them up to make those observations and hone in on that instead of having to run the, uh, the metrics and, and that sort of stuff.
Sean Martin: Nice one.
Ruben Perales III: Mm-hmm.
Sean Martin: Nice one. Well, I'm, I'm ful as a journalist. I know I can't get all the nitty gritty. But I'm hopeful maybe people ask you questions, you might be able to share stuff. Mm-hmm. Mean close doors. Um, so I encourage folks to connect with you, but before I let you go, I want to touch on the AI and the SOC bit. 'cause you talked, you had a session on that. So Yeah. What can you share for, for that
Aaron Bond: yeah, I, I, I think really for that session, so it is not a presentation, [00:14:00] it's a round table, right? We're we want to bring a group of people together and try to help them ans or, uh, solve problems that maybe they, they don't know the answers to right now. Um, and so we, we've. We've Done a lot in the way of developing AI into the processes of our SOC, um, in in response and threat hunting in the tabletop process, et cetera. Um, and, and one key area I think also is around like the QA environment, and freeing up analysts to spend less time on QA and alerts. Um, and so that's really what that conversation is about, right? It's a conversation between practitioners and leaders around how do they use AI in the SOC today? What problems are they solving and how can we help solve?
Sean Martin: Yeah. And do it responsibly, I would imagine.
Aaron Bond: Absolutely. Yeah,
Sean Martin: because all I'm thinking is you have all this AI in there, where is it connecting? What data's in there? Mm-hmm. You have to do that responsibly.
Ruben Perales III: Yeah. Mm-hmm.
Sean Martin: Well, you guys are amazing. I appreciate you. Uh,
Ruben Perales III: thank you very much.
Sean Martin: Running down.
Ruben Perales III: Yeah.
Sean Martin: Across from the other, the other county to have this chat and sharing this with me. Um, I'm certain everybody's gonna enjoy this conversation and encourage you to connect with Aaron and, and Ruben. And, uh, I still have more coming here from, uh, Denver. ISC2 Security Congress, so stay tuned ITSPmagazine.com and uh, we'll see you Allall soon.