The Friday-4 p.m. tabletop: rehearsing the freight breach before it happens

The worst time to read your incident-response plan is during the incident. Here's how a quarterly tabletop with ops, dispatch and accounting saves carriers six figures.

Most carriers have an incident-response plan in the same way they have a fire-extinguisher manual: it exists, somewhere, and no one has opened it. The problem is that a cyber incident moves fast and crosses departments — IT, dispatch, accounting, leadership, sometimes legal and insurance — all at once. If the first time those people coordinate is during a live encryption event, you lose the hours that matter most. A tabletop exercise fixes that by rehearsing it on a calm afternoon instead.

What a tabletop actually is

A tabletop is a guided, scenario-based walkthrough — no systems are touched. A facilitator presents a realistic incident and the team talks through exactly what each person does, in order. For a carrier, the scenarios write themselves:

• ★The spoofed broker: a lookalike domain has redirected a $180k factoring payment. Who freezes it? Who calls the bank? Who calls the real broker?
• ★The encrypted TMS: dispatch can't pull loads at 4 p.m. Friday. What's the manual fallback? Who decides on disclosure? Where are the offline backups?
• ★The account takeover: your FMCSA contact details were changed without authorization. Who detects it, who restores it, who notifies brokers you work with?

Why it pays for itself

The losses from an unrehearsed response are on the public record. One logistics firm reported tens of millions of dollars in demurrage and incident costs after a single cyberattack; another estimated $7.5 million in lost revenue from a ransomware-driven outage. IBM's 2025 research puts the average breach at $4.4 million. Against numbers like those, a quarterly half-day exercise is the cheapest insurance you'll ever buy — and unlike insurance, it actually shortens the incident.

The teams that survive a breach cleanly aren't the ones with the thickest binder. They're the ones who'd already had the argument about who calls the bank — before the money was moving.

What a good quarterly cadence covers

Run it every quarter because your people, vendors and systems change. A strong rotation:

• ★Q1 — Ransomware / TMS down. Continuity and backups.
• ★Q2 — Payment-redirect / BEC. Finance and verification process.
• ★Q3 — Identity / FMCSA account takeover. Detection and regulator coordination.
• ★Q4 — Full-chain cargo-theft scenario. The FBI's cyber-enabled theft playbook, end to end.

Each session ends with a short list of concrete fixes — a missing backup, an unclear escalation path, a phone number no one had. Those fixes are the real output. Over a year, the plan stops being a binder and becomes muscle memory.

Want to run your first tabletop with ops, dispatch and accounting in the room? Book a free exposure check — no pitch, 72-hour reply.