In this episode, I sit down with Matt Hartley, co-founder of BreachRx, to talk about incident readiness and the case for AI-accelerated micro tabletops. Matt has spent 28 years in cybersecurity. He did offensive security work in government, ran product at iSight Partners, and later led Mandiant Engineering after FireEye acquired iSight.
Tabletops are something we all agree we should be doing, and few organizations do them well. The typical version is an annual event built around a slide deck in a conference room, and it rarely resembles how the team will actually respond. Matt makes the case for smaller, more frequent exercises, including ones that run in the background over a week and close with a thirty-minute hot wash, run inside the same tooling the team will use during a real incident.
We also get into the regulatory clocks that now sit on top of every incident, with Matt pointing to more than 200 notification laws worldwide, and how privilege and discoverability should shape the way teams document both exercises and incidents. His warning that privileging everything leaves nothing privileged is one that security and legal teams should hear together.
Looking ahead, we discuss why Matt expects concurrent incidents to become the new floor as AI raises attacker capability, and what regulators and plaintiffs will ask for when they want proof of continuous readiness.
Prefer to listen?
We discuss:
Matt’s path from offensive security and threat intel to Mandiant, and what he saw in organizations that were compromised and unprepared
What a micro tabletop looks like, from a one-hour session with the comms team to an exercise that runs asynchronously over a week
“Train like you fight,” and the value of exercising in the same platform you’ll use during a real incident
Feeding lessons learned back into procedures and keeping a defensible record that exercises happened
Notification timelines across jurisdictions, from DORA’s four-hour clock to the much shorter windows Matt cites in China and India
Separating the factual record from privileged conversations, and the risk of dozens of Slack and Teams channels spinning up around a single incident
Keeping frequent exercises from turning into checkbox compliance by rotating threats pulled from the news
Running two incidents at once, and why Matt sees AI pushing that from edge case to baseline
Where AI agents help in incident response, including scenario generation, procedure building, and incident reporting
How a CISO with an annual tabletop already on the calendar can run a first micro tabletop next month
What “do you have a process, do you follow it, and can you prove it” means for regulators reviewing years of incidents
Timestamps
0:00 Intro
0:42 Matt’s background in offensive security, iSight, and Mandiant
1:03 What pushed Matt toward incident response
3:07 What an AI-accelerated micro tabletop looks like
7:15 Exercising in the platform you’ll respond in
9:47 Regulatory notification clocks
12:02 Privilege and discoverability in exercises
15:37 Keeping frequent exercises from becoming checkbox compliance
17:48 Concurrent incidents and AI-driven attacks
20:56 AI agents in incident response
23:00 Running your first micro tabletop
25:45 Proof of continuous readiness
28:36 Where to find Matt
