Cybersecurity teams spend enormous amounts of time preparing for incidents they hope will never happen. Yet one of their most important preparation tools, the tabletop exercise, often amounts to little more than a compliance ritual: Gather the team, walk through some PowerPoint slides, discuss a hypothetical ransomware attack and return to work with little practical improvement to show for it.
K.C. Yerrid, founder and CEO of Webelo Solutions, believes the industry has been approaching the problem backward. Incident response is a skill that requires repetition, experimentation and experience. Unfortunately, traditional tabletop exercises make all three unnecessarily difficult.
During a presentation at CYBR.SEC.CON. 2026, Yerrid introduced DICE (Defensive Incident Containment Exercises), a free, AI-powered incident response simulation platform that borrows the mechanics of Dungeons & Dragons to turn passive security training into an interactive game.
The objective is straightforward: Make practicing incident response easy enough that security teams actually do it regularly.
Full presentation:
The problem isn't just boring tabletop exercises
Yerrid argued that traditional tabletop exercises suffer from two related problems: They're often boring, and they're difficult to sustain.
The cybersecurity community has already made progress on the first problem through games such as Backdoors and Breaches, developed by Black Hills Information Security. By introducing cards, randomness and collaborative decision-making, the game transformed tabletop exercises into something security practitioners could genuinely enjoy.
But enjoyment only solves half the equation.
"Backdoors and Breaches solved engagement for us," Yerrid told attendees. "What it didn't do is it didn't solve facilitation."
Someone still has to organize the session, develop scenarios, moderate the discussion and keep participants moving. That responsibility usually falls to an already overworked security professional who eventually tires of playing incident master.
Without a willing facilitator, the exercises stop.
For Yerrid, the consequences extend beyond wasted training opportunities. Incident response skills deteriorate without regular practice, leaving organizations dependent on capabilities their teams haven't exercised under realistic conditions.
"Incident response is a skill," he said. "You can't just turn it on, turn it off."
Dungeons & Dragons meets incident response
DICE replaces the human facilitator with an AI moderator that functions much like a Dungeon Master in Dungeons & Dragons.
Participants select character classes corresponding to actual cybersecurity responsibilities, including security analyst, threat hunter, incident responder, security engineer, intelligence officer and incident commander.
Each class has distinct capabilities, strengths and weaknesses. A threat hunter might investigate suspicious activity, while an incident commander coordinates the response. Attempting actions outside a character's expertise can carry penalties.
As an attack unfolds, players select actions, explain their reasoning and roll virtual dice to determine outcomes. The AI then narrates the consequences and advances the scenario.
A seemingly sound containment strategy might fail. An unexpected discovery might expose an attacker. A poor decision could allow the adversary to advance further through the attack chain.
The important distinction is that the exercise changes based on what participants actually do.
Traditional tabletop exercises ask what a security team would do during an incident. DICE asks players to make decisions and then confront the consequences.
"There's a big difference between introspective and interactive," Yerrid said. "The feedback loop is where the muscle memory gets built."
The platform includes roughly 150 predefined scenarios, according to Yerrid, while allowing organizations to build their own exercises around specific environments, attack techniques and operational priorities.
AI eliminates the facilitator — and the scheduling problem
One of DICE's more consequential capabilities is solo play.
Security professionals can practice incident response without assembling a team, scheduling a meeting or finding someone willing to run the exercise.
A junior analyst can work through an investigation without a supervisor hovering over their shoulder. An experienced responder can experiment with unfamiliar attack scenarios. Teams can run short drills instead of waiting months between formal tabletop exercises.
Yerrid said introductory sessions typically last 15 to 30 minutes, although more involved scenarios can run considerably longer.
For organizations, the platform also supports multiplayer exercises, with participants joining through a local network and collaborating through familiar communication tools.
DICE generates a post-exercise report containing performance metrics, decision logs, grades, missed opportunities and a recommended response sequence. Those records can help teams identify weaknesses and document training activity.
Yerrid also demonstrated certificates intended to support continuing professional education submissions, although acceptance of credits ultimately depends on the relevant certification organization's requirements.
Keeping AI from inventing a dragon in the data center
Introducing generative AI into security training raises an obvious concern: What happens when the model hallucinates?
Yerrid addressed that directly.
DICE separates the AI's storytelling responsibilities from the underlying game mechanics. The AI narrates events, but the application's code controls the game state, dice rolls and grading.
"The DM narrates the game, it doesn't keep the score," he explained.
Scenarios are grounded in MITRE ATT&CK techniques, while schema validation and constrained actions are intended to keep the simulation within defined boundaries.
That distinction matters. An AI model that can arbitrarily change the rules would undermine the credibility of the exercise.
It also highlights a broader principle for organizations adopting AI-driven security tools: Use AI where adaptability adds value, but keep consequential controls grounded in deterministic systems.
DICE currently runs on Windows and requires users to supply their own AI provider API key. Yerrid described support for major AI model providers, with Mac, Linux and local-model capabilities among future development priorities.
The application is distributed under the Apache 2.0 license, with source code available on GitHub. While the software itself is free, external AI API usage may incur costs.
The bigger lesson: Practice has to become routine
DICE's real promise isn't that cybersecurity professionals can pretend to be Dungeons & Dragons characters while hunting attackers. It's that organizations may finally have a practical way to make incident response training continuous rather than occasional.
That doesn't mean AI-driven simulations can replace every traditional tabletop exercise. Executive crisis coordination, legal decisions, regulatory communications and cross-functional relationships still benefit from human-led discussion and realistic organizational pressure.
Nor does an AI-generated performance grade necessarily establish that a practitioner is ready for a real incident. DICE's effectiveness as a training tool will need to be judged by how well its lessons translate into operational performance.
But Yerrid has identified a genuine obstacle: Training that requires too much preparation simply doesn't happen often enough.
"I basically built this because I was tired of watching good security teams skip practices that they couldn't schedule and couldn't afford," he said.
The lesson for cybersecurity leaders is that incident response readiness isn't built during an annual tabletop exercise. It's built through repeated decisions, mistakes, adjustments and practice.
If AI can remove the administrative burden standing between security professionals and that repetition, the most important innovation may not be the game itself.
It may be that teams finally have fewer excuses not to practice.
