What Hugging Face Teaches Us About The Need for Continuous AI Tabletop Exercises

For years, the cybersecurity tabletop exercise has followed a familiar model: spend weeks planning a scenario, coordinate calendars across multiple teams, run a half-day or full-day exercise, document the findings, and do it all again next year.

But emerging threats rarely wait for the next annual exercise. The July 2026 Hugging Face incident is a useful example of how quickly a new attack pattern can create questions for security, legal, privacy, communications, and executive teams. Organizations should be able to turn an event like this into a relevant tabletop exercise while the lessons are still current—not months later.

That is the shift from tabletop exercises as an annual event to readiness as an operating capability. Threats, teams, regulations, technologies, and business conditions change continuously. The way organizations practice responding should be able to change just as quickly.

Introducing AI Tabletops on Demand

BreachRx AI Tabletops on Demand, powered by Rex AI^® and built on the Rex Platform™, makes that cadence practical. Agentic AI can reduce the work required to prepare, run, and document realistic exercises from weeks to minutes. Teams can run focused micro tabletops throughout the year and still use larger enterprise tabletops when broader participation is needed.

The offering supports:

• Scenario design
• Facilitator preparation
• Live exercise execution
• Documentation and reporting
• Follow-up improvements

Micro Tabletops Make Continuous Readiness Practical

Micro tabletops give teams a simple way to practice one problem at a time. A session can focus on a single team, handoff, decision, control, or emerging threat pattern, which makes it easier to fit meaningful exercises into normal operating schedules.

OpenAI and Hugging Face reported that models in an internal cyber-capability evaluation exploited a zero-day to gain internet access and later compromised Hugging Face infrastructure.

A 30- or 45-minute tabletop based on the incident could ask teams to work through:

• Incident classification
• Containment
• Attribution
• Notification requirements
• Public and customer messaging

Large enterprise tabletop exercises remain valuable for testing the organization as a whole. Smaller sessions between them give teams more repetitions and more chances to rehearse roles, escalation paths, approvals, communications, and handoffs before an actual incident puts those decisions under time pressure.

What a Year-Round Micro Tabletop Program Can Look Like

Practice Concurrent Incidents

Concurrent response deserves dedicated practice. A team might be managing ransomware when a third-party compromise creates a second stream of regulatory, customer, and executive demands. Running both at once shows where staffing, ownership, communications, or decision-making starts to strain.

Rotate Through Departments

A year-round program can rotate exercises across the organization:

• Security and IT
• Legal and privacy
• Communications
• Executive leadership
• Business units
• Outside partners

AI Tabletops on Demand supports annual, monthly, and even biweekly exercises for the groups that need them.

Keep Cyber Talent Engaged

More frequent exercises also create room for better scenarios. Teams can work through AI-enabled identity compromise, cloud incidents, supply-chain attacks, insider threats, compromised credentials, and new attack patterns as they emerge. Experienced responders get harder decisions to solve, while newer team members get more opportunities to practice.

Answer the Board’s Inevitable Question

Major industry incidents often reach the board quickly. When directors ask whether a similar event could happen to the organization, response leaders can build a tabletop around the new attack pattern while it is still current, run it with the teams that would own the response, and show leadership what the exercise changed–before they even get a chance to bring it up in the next board meeting.

Build Muscle Memory for Out-of-Band Communications

A ransomware incident or identity-system outage is a poor time to discover that employees do not know how to leave corporate email and collaboration tools. Micro tabletops can make participants activate protected out-of-band communications during practice, use the environment to coordinate and make decisions, and repeat the process until the transition feels familiar.

Validate Playbooks, Onboard Commanders, Retest Weak Points

The same approach works for operational changes. Teams can use micro tabletops to:

• Validate an updated runbook
• Onboard a new incident commander
• Rehearse a regulatory notification decision
• Test a third-party handoff
• Revisit a weakness identified in an earlier exercise

Rex AI can adapt the scenario around the procedure being tested and surface outdated steps, missing information, unclear ownership, and weak handoffs.

Practice in the Same System You’ll Use When It Is Real

AI Tabletops on Demand uses the Rex AI Exercise Agent and is coordinated through Maestro, the Rex Platform’s primary coordinator agent. The Rex AI Exercise Agent and Maestro can generate:

• Facilitator content
• Exercise injects
• Timelines
• Discussion prompts
• Participant materials
• Follow-up reporting

Participants work inside the governed Rex environment. AI actions are timestamped and attributable in the exercise record, and access-controlled workspaces can separate privileged legal discussions from broader response activity.

Turn Every Exercise Into the Next Improvement

The exercise record captures decisions, observations, gaps, and assigned follow-up work as the session runs. Teams can use that record to produce after-action reports, executive summaries, gap analyses, and prioritized improvements without rebuilding the exercise from notes, email, and meeting transcripts.

Each session can feed the next one. A gap found in an exercise becomes a procedure change or assigned action; the updated procedure can then be tested again. Over time, the organization builds a current record of what has been practiced, what changed, and where more work is needed.

See What a Tabletop Guidebook Should Look Like

Download the Autonomous AI Agent Data Breach Tabletop Exercise Guidebook, a facilitator-ready scenario modeled on public reporting around the July 2026 Hugging Face incident. The exercise runs about 60 to 75 minutes and uses four escalating injects to test detection, attribution, legal and regulatory questions, customer communications, and post-exercise follow-up.

As a BreachRx customer, you can use Maestro to quickly build an exercise around the threat, team, procedure, or decision you want to rehearse. AI Tabletops on Demand can turn that prompt into a tailored scenario you run on your own schedule, while BreachRx-moderated tabletops add expert facilitation for teams that want a guided exercise. Both approaches use the governed Rex environment for live response, capture decisions and findings as the exercise unfolds, and carry those insights into follow-up actions and future exercises.