Technology-Enhanced Tabletop Exercises for Cybersecurity Education: Lessons Learned

Innovative practice paper examining the integration of technology-enhanced tabletop exercises into cybersecurity curricula. Addresses the gap between professional TTX practice and university adoption, presenting lessons learned from implementation in computing education contexts.

Key Findings

A web application (IXP) was designed to automate exercise delivery and enable data-driven evaluation of tabletop exercises (TTXs).

Unlike traditional pen-and-paper TTXs, IXP automatically delivers scenario updates, facilitates team discussions, and collects interaction data for automated assessment.

The approach enhances realism, reduces instructor workload, and offers actionable insights into student learning behaviors.

Automated data collection enabled analysis of team performance, communication patterns, and decision-making processes across 25 TTXs delivered from October 2024 to March 2026.

Post-exercise feedback from trainees and instructor observations indicate improved student engagement and collaboration, and faster feedback compared with traditional teaching methods.

Study Design & Method

A cybersecurity tabletop exercise is a conversation between participants responsible for fulfilling a variety of roles during a cybersecurity incident. The paper describes the design, delivery, and evaluation of 25 TTXs using the IXP platform from October 2024 to March 2026. The exercise lifecycle — planning, development, delivery, and post-exercise reflection — structures the lessons learned, which include recommendations for realistic, well-thought-out scenarios and for instructor support during the exercise. Although the recommendations are grounded in cybersecurity, the authors argue they are not domain-specific and can be used for digital TTXs in other areas.

Implications for AI in Education

The work demonstrates how technology enhancement can close the gap between professional TTX practice and university teaching: automated scenario delivery, team discussion facilitation, and interaction-data collection turn an experiential exercise into a measurable learning event. The combination of experiential learning with analytics is the platform's distinguishing value — instructors gain insight into team performance, communication patterns, and decision-making without manual observation, and students receive faster feedback. For Active Learning and Professional Training contexts beyond cybersecurity, the lessons learned offer a transferable template: prioritize realistic scenarios, design for instructor support, and instrument the exercise from the start so that evaluation is a byproduct of delivery rather than an afterthought. The work also contributes to CS Education practice and to Learning Analytics approaches for hands-on, collaborative learning formats in Higher Ed.

Connected Concepts

Professional Training

Socratic AI Dialogue

Math Education

Curriculum Design

Connected Articles

Multi Site VR Immersive Learning — Design and Implementation of a Real-time Multi-site Immersive Learning System Using Photon Fusion

Forap PjBL Computing Education — Adoption-Ready Project-Based Learning for Computing Education: The FORAP Framework and a Multi-Scale Project Portfolio

Visual Query Tracer Declarative Logic Learning — Evaluating a Visual Query Tracer and Builder for Learning Declarative Logic Programming

Q Learning Lab RL Teaching — Q-Learning Lab: Teaching Reinforcement Learning Through Learner-Generated Trace Analysis

LLM Design Problems Hot PjBL — LLM-Generated Design Problems for Assessing Higher-Order Thinking in Project-Based Learning

Vibe Coding Programming Process Visualizer — From Idea to Classroom in Days: Using "Vibe Coding" to Create a Programming Process Visualizer from IDE Activity Logs

Citation

Jan Vykopal, Pavel Čeleda, Martin Horák, Valdemar Švábenský (2026). Technology-Enhanced Tabletop Exercises for Cybersecurity Education: Lessons Learned. arXiv:2607.28179. cs.CY, cs.CR.