A Mundane Insider Tabletop With Delivery Colleagues

Most delivery organisations know insider risk is real. Far fewer sit the people who actually see exports, shared logins, and late files in a room for one hour and ask what they would do Monday morning. The gap is not missing threat intelligence. It is missing facilitation — a session that names ordinary paths data leaves, without hoodies, without APT injects, and without turning a colleague into the villain for the afternoon.

That session is worth running. Not because delivery teams need another security awareness slide. Because the behaviours that concentrate insider paths — continuity pressure, audit gaps, temporary access that outlives the ticket — are the same behaviours those teams already manage during handover and incident weeks. A Facilitation Frame on three Desk-Scale Scenarios surfaces process fixes a SOC deck never reaches.

Continuity Theatre — when the exercise becomes performance

Call the failure mode Continuity Theatre. It looks rigorous. Someone imports a cinematic scenario, invites half the company, and spends forty-five minutes on whether the attacker exfiltrated through a zero-day. Delivery people leave polite and unchanged. The shared login stays in the wiki. The export habit stays unnamed.

Three reasons it persists. Logically, cinematic exercises feel like "real" security work — they match the breach headlines. Evidentially, the gaps that actually hurt delivery programmes are mundane: a prod slice on a personal drive, ops_readonly still shared, a batch file that arrived late and nobody owns the decision path. Consequentially, Continuity Theatre trains performance. Teams learn to survive the afternoon, not to fix the export path before the next leaver week.

Government exercise libraries — NCSC Exercise in a Box, CISA tabletop packages — are legitimate starting points. They assume senior leaders, HR, and comms in the room. Delivery teams can borrow the shape — discussion-based, 30–60 minutes, capture gaps — without importing the cast list or the nation-state plot. Mundane beats cinematic when the audience ships warehouse integrations, not threat models.

Who Belongs in the Room

Keep the room small and operational.

• Delivery lead or analyst — owns continuity stories and knows which exports are "normal."
• Engineer or ops representative — knows where logs actually live and which accounts are shared in practice.
• Scribe — captures decisions and gaps; can be a security liaison if they agree not to lecture.
• Optional sponsor — listens; does not perform outrage.

You do not need a red team. You do not need legal on speed dial for the first run. You need people who would recognise the late file, the shared login, and the silent export if they walked past them on a Tuesday.

The Facilitation Frame

Run 45–60 minutes. Pick one primary Desk-Scale Scenario and one inject that shifts a constraint mid-discussion — the same move you would use in a structured interview, applied to process instead of a candidate.

Before you start. State the contract aloud: behaviours and gaps, not blame; no one is being accused; the output is three process fixes the team can own. Name Continuity Theatre and refuse it — if the room starts narrating APTs, bring them back to the warehouse feed and the wiki password.

During. Read the scenario once. Ask who notices first, who can act, what the sanctioned path is, and what actually happens under deadline pressure. When someone says "we would never," ask what they did last quarter. Scribe writes: owner, detection path, sanctioned alternative.

After. Close with three lines on a shared doc — not a twenty-page after-action report nobody reads. Schedule one fix with a date. That is the whole product.

Desk-Scale Scenario 1 — The Late File

Setup. The nightly warehouse stock feed usually lands by 02:00. Receiving runs the mapper at 04:30. Tonight the file arrives at 05:40. Staging still holds yesterday's partial run. The on-call phone is unanswered because "it usually clears itself."

Discussion questions. Who decides whether to hold receiving or run on stale data? Where is that decision recorded? What alert should have fired — and who owns it? What would a leaver do if they needed to prove the pattern before Friday?

Inject. Finance moves the close window two hours earlier. Freshness now means before 06:00, not end of day. What changes in who must be in the loop?

This scenario is insider-relevant without a villain. It tests whether privileged paths — rerun buttons, manual overrides, shared on-call logins — get used without attribution when continuity pressure spikes. It connects to the same ordinary failure paths you might probe on a spec before sign-off — here you exercise response, not document prose.

Desk-Scale Scenario 2 — The Shared Login

Setup. The team wiki still documents ops_readonly for the receiving dashboard. Three people know the password. A contractor replacement starts next sprint; MFA enrolment is stuck in a ticket queue. Someone suggests leaving the shared account "just until go-live."

Discussion questions. Can you attribute an action taken through that login last Tuesday? What breaks if the person who knew the password leaves Friday? What delegation path exists instead of sharing?

Inject. HR confirms Friday is the last day for the analyst who rotated the password last year. Nobody remembers who has it written down.

NCSC guidance on shared access is plain: sharing work accounts negates user-specific authentication and destroys auditability. CERT's insider corpus repeatedly shows reconnect paths through unchanged shared credentials after termination. The tabletop output is not "password bad." It is: named owner for rotation, delegation alternative, and a leaver-week check that does not rely on memory.

Desk-Scale Scenario 3 — The Silent Export

Setup. An analyst exports a filtered prod customer list to investigate an address-format defect. The CRM audit log shows the export. The file lands on a personal OneDrive "so the team is not blocked if IT locks the account." The ticket references the export. Nobody asks where the copy lives after the defect closes.

Discussion questions. Who can still read that file six weeks later? What is the sanctioned investigation path? What would "done" look like for deleting or vaulting the copy?

Inject. The analyst enters a notice period. The knowledge pack grows — contact extracts, exception orders, screenshot threads with real names. Each item has a continuity story. Each item is also a new home for data outside the system that was meant to govern it.

This is where facilitation meets what delivery people already see in handover week — not theft theatre, but a bundle of ordinary exits pressed into a shorter window. The tabletop names the silent export habit on an ordinary Tuesday too; the sibling piece on export habits owns the retrospective angle. Your job here is to run the room once and capture whether investigation exports have a retention owner.

What to Capture — and What to Stop

Stop when you have three owned fixes — not when everyone has performed concern. Stop when the room starts inventing attackers to feel productive. Stop if the scribe's page is empty; that is Continuity Theatre winning.

Capture only:

• Owner — who rotates the shared login, who approves prod exports, who gets paged on late files.
• Detection path — what signal fires before a human hero phone call.
• Sanctioned alternative — delegation, vault ticket, or staging rule the team will actually use under deadline pressure.

Run one scenario per quarter if that is all the culture will bear. Run it with the same people who sit in incident bridges, not with an audience imported for optics. Departure windows concentrate movement; your tabletop does not need to accuse leavers. It needs to fix the paths that make movement invisible.

Mundane scenarios beat cinematic injects. Small rooms beat imported audiences. Three dated fixes beat a binder nobody opens.

The insider you are exercising against is not a hooded stranger. It is the late file nobody owns, the login nobody rotates, and the export nobody deletes — sitting in plain sight until delivery colleagues are asked, calmly, what they would do Monday morning.