About
We run one thing, and we sell nothing else.
MyTabletops builds and facilitates cybersecurity tabletop exercises for the leadership teams of mid-sized organisations, then writes the report their insurer, broker or auditor asked for.
That is the whole business. No managed services, no monitoring, no products, no remediation contracts waiting on the other side of a finding.
The narrowness is not modesty. It is the reason our signature on an attestation means something.
The fastest way to judge us is 20 minutes and a sample report.
Book a 20-minute scoping callThe definition that matters
What does independent actually mean here?
Most of the time the word means unaffiliated, which is nearly useless. Plenty of unaffiliated people have a reason to want your report to read a particular way.
Independence in an attestation has three specific parts, and all three have to hold.
- We did not build it. We did not write your incident response plan, configure your backups or design your controls, so we are not assessing our own work.
- We do not operate it. We have no ongoing access to your environment and no contract that depends on it staying quiet.
- We have no financial interest in the finding. There is nothing we sell that a bad result would sell more of. A clean exercise and a difficult one earn us the same fixed fee.
That third one is the part people skip, and it is the one an underwriter is really testing when they ask who ran the exercise. An assessor who also sells the remedy has an interest in the diagnosis.
Structural, not promised
What could we sell you off the back of a bad finding?
| If the exercise exposes | What we could sell you to fix it |
|---|---|
| Backups that were never restore-tested | Nothing. That is your MSP's work. |
| No agreed authority to declare an incident | Nothing. That is a governance decision. |
| Crisis communications that fell apart | Nothing. We do not do comms retainers. |
| An out-of-date incident response plan | Nothing. We test plans, we do not write them. |
| Gaps in detection or endpoint coverage | Nothing. We sell no tooling and resell none. |
Every row is a reason someone else would want the finding to exist. None of them pays us. That is what makes the independence structural rather than a claim on a page.
Your facilitator
Who will be in the room?
An experienced incident response facilitator who has built and run scenarios for government, financial services and healthcare organisations, in environments considerably messier than a 50 to 300 person company.
You meet them on the scoping call, before money changes hands. Their name, title and credentials are set out in your engagement letter and signed on the attestation page of your report. That page is what your carrier reads, so that is where the name belongs and that is where it is.
On the Annual Readiness Program it is the same facilitator for the full term, which is the point of the programme. Someone who already knows your business is in the room when your broker starts asking.
Why the company exists
Why does a company this narrow need to exist?
Because the market gave mid-sized organisations two options and neither one worked.
Option one is a free template you run yourself. Useful practice, and it produces no evidence, because nobody independent watched. Option two is a national firm that will quote a company your size a multiple of our price, often for a scenario off a shelf and a report that reads like it was generated rather than written.
A leadership team of 50 to 300 people should be able to buy the real exercise without buying the overhead attached to it.
So the scope is fixed and the price is fixed. 3 hours in a room with your leadership team, a written after-action report 15 days later, and a signed attestation. Currently $15,000 CAD, agreed before anything starts.
Frequently Asked Questions
Who will actually facilitate our exercise?
An experienced incident response facilitator who has run scenarios for government, financial services and healthcare organisations. You meet them on the scoping call, before you commit to anything. Their name, title and credentials appear in your engagement letter and are signed on the attestation page of your report, which is the document your carrier, broker or auditor reads. That is where the name has to be, and that is where it is.
Why is there no team page with photographs?
Because it would not tell you anything you can act on. A headshot does not establish whether somebody is independent of your controls, and it is not what an underwriter examines. What they examine is the report and the signature on it. We would rather spend the page explaining what independence means and let you judge the facilitator on the scoping call.
Are you an MSP, an MSSP or a consultancy?
None of the three. We do not manage environments, we do not monitor them, we do not sell or resell security products, and we do not take remediation work. We run facilitated exercises and write the reports. That is the entire business, and the narrowness is deliberate rather than a stage we are growing out of.
How long have you been doing this?
MyTabletops is a young company built by people who have been running incident response exercises considerably longer than the company has existed. We would rather say that plainly than pad a history page. Judge the work on the sample report and the scoping call, both of which are free.
Do you work with organisations outside Canada?
Yes. We are based in Ontario and work across Canada and in the United States. Reports are structured for the carriers writing cyber policies in both markets. Canadian pricing is in Canadian dollars.
What happens to what you learn about our organisation?
It stays with your organisation. We do not reuse your scenario with another client, we do not use exercise material to train public AI models, and we do not name you as a client anywhere without written permission. The detail is in our privacy policy, and you decide what documentation we see before we see it.
Meet the facilitator before you commit to anything.
20 minutes. We ask about your renewal date, the plan you have now, and who would be in the room. If a tabletop is not the right thing for you yet, we say so.