AI-driven vs consultant-led tabletop exercises: an honest comparison

For twenty years, the tabletop exercise market has had one model: hire a consultancy, spend weeks on intake and scenario design, gather everyone in a room for an afternoon, and receive a PDF three weeks later. The model produces good exercises. It also produces, in most organizations, exactly one exercise per year — because that's what the budget and calendar survive.

AI changes the economics, and with them, the format. Here's an honest comparison — including where the traditional model still wins.

How the consultant-led model works today

A typical engagement: an intake workshop, two to four weeks of scenario preparation, a facilitated session (often half a day, on-site), and a findings report. The consultant brings real value at specific points — incident experience, the authority to challenge senior executives, and pattern knowledge from other clients' incidents.

The structural problems aren't the consultant's fault; they're the model's:

• Cost concentrates practice. At €10k+ per session, exercising becomes an annual event rather than a routine.
• Preparation doesn't compound. Next year's exercise restarts the intake; the scenario knowledge leaves with the consultant.
• Scheduling is the silent killer. Getting eight calendars and one consultant aligned pushes exercises back months — and a postponed exercise is usually a cancelled one.
• Documentation is manual. The transcript is whatever someone typed in the corner.

What AI-driven exercises change

An AI-native platform inverts the cost structure. Scenario design — the expensive part — is generated: from your organization profile (industry, size, revenue, systems, regulatory frameworks) and from your actual policy documents, which become the exercise's ground truth. Roles you can't staff are played by AI agents in character. Inject delivery, timing, and logging are automatic. The debrief report generates itself from the transcript.

The consequences compound:

• Frequency becomes the default. When an exercise costs minutes of preparation, quarterly or monthly practice is just a calendar entry. Response capability is built by cadence, not by one excellent afternoon.
• One defender can train. The traditional model needs a quorum; AI agents remove it. A solo security manager can run a full team exercise on a Tuesday morning.
• Evidence is a byproduct. Transcripts, response times, compliance scores, and follow-up actions exist automatically — which is precisely the Article 21 evidence trail NIS2 auditors ask for.
• Exercises test documents. Because scenarios are generated against your IR plan and policies, the exercise systematically exposes where those documents are silent or wrong.

Cost: a realistic comparison

	Consultant-led	AI-driven
Per exercise	€5,000–€25,000	Included in subscription (≈ €99–500/month)
Preparation time	2–4 weeks	Minutes
Realistic frequency	1×/year	Weekly to quarterly
Cost per practiced person per exercise	High and fixed	Falls with every session

The honest framing: a year of an AI platform typically costs less than one consultant-led exercise, and produces ten times the practice hours.

Where consultants still win

Three scenarios where we'd recommend bringing in a human expert — yes, really:

1. Board-level crisis exercises with political stakes. When the exercise's real purpose is getting a divided executive team aligned, an experienced moderator reading the room beats software.
2. Inter-organizational simulations. Sector-wide or supply-chain exercises with multiple companies need a neutral orchestrator with convening power.
3. The first-ever exercise in a low-maturity organization — where the consultant's job is partly organizational therapy: explaining why this matters, to people who don't yet believe it.

The hybrid approach

These models aren't exclusive. The pattern we see working: routine practice on the platform (monthly drills, quarterly team exercises, every new joiner runs one in onboarding) plus an annual consultant-led capstone for the board, informed by a year of platform debriefs showing exactly where the organization struggles. The consultant arrives with better data; the platform exercises get validated by an outside expert. Both get better.

How to choose

Ask one question: what's limiting your response capability today — expertise or repetition?

If your team has never exercised and your leadership needs convincing, start with one consultant-led session to build buy-in. If you know what good looks like and the problem is that practice happens once a year, the bottleneck is the model itself — and that's the problem AI-driven exercises remove.