u/VegetableFault5149

Running IR tabletops for clients as part of our security offering, and the math is brutal. Every client needs something built around their setup: different tech stack, different threat landscape, different compliance driver (SOC 2 for some, HIPAA for others).

Custom scenario research and report writing eats most of a week per engagement. It's profitable per-client but it doesn't scale. I can't add clients without adding headcount, and that kills margin.
We started testing an AI-driven tabletop platform to see if it'd help. It generates a company-specific scenario from OSINT in under an hour instead of days, and the facilitation and reporting is handled by the platform so we're not writing the after-action report from scratch every time.

Still deciding how it fits into our delivery model long-term, but it's the first thing that's cut prep time instead of adding another tool to manage. Has anyone else solved this a different way? What's your prep-to-delivery ratio looking like?

Every time a new cyber threat campaign or headline breach appears, my CISO comes in Monday morning with the same question: “are we covered for this” Turning that into a clear, defensible answer about our detection coverage and security posture is becoming a separate job.
We have what most people would call a mature security stack in 2026: a central SIEM, EDR on endpoints, cloud and identity logs, some threat intelligence and custom detection rules. We can show that controls are deployed, that we have rules for specific MITRE ATT&CK techniques, and that dashboards report healthy alerting. None of that directly answers whether we would detect a specific attack path in time or where the real detection gaps are.
Right now our detection coverage assessment process for new campaigns is manual. We map the campaign to MITRE ATT&CK techniques, check which techniques already have detections in the SIEM and EDR, and run quick lab tests or simulations to see if those alerts would fire. This threat‑informed detection engineering approach works, but it is slow and inconsistent; the output depends on who performs the review, how deep they go, and how much time the team has during incident response and day‑to‑day SOC work.
If you support a CISO or security leadership team, how do you answer the question in a way that your CISO can use confidently in a mng meeting without oversimplifying or overstating the reality?

Our company has grown a lot over the last year and email signatures have somehow turned into a bigger headache than I expected.

Right now everyone seems to have a slightly different version. Some people update their job title, others forget to add new branding and every now and then someone copies an old signature from a co worker and it just gets more inconsistent. it doesn't sound like a huge deal until you realize hundreds of emails are going out every day.

I have been looking at email signature software instead of having everyone manage their own, but there are way more options than I thought. Some seem focused on simple signatures while others include banners, analytics, centralized management and all kinds of extras that I am not sure we would even use.

If you have rolled out an email signature management tool across a company, did it actually make life easier or did it create another thing to maintain?

I am replaying Shadow of War and creating custom dynamic rivalries with randomly generated Orcs who remember how I killed them 10 hours ago. It’s mind-blowing that we are almost a decade out and NO OTHER GAME has this feature simply because WB locked it behind a patent and then abandoned it. Imagine this system in a Star Wars or Batman game.