The Challenge
Cybersecurity education and IT governance curricula struggle to effectively prepare students for complex, collaborative incident response under real-world pressures. Although tabletop exercises (TTXs) are widely utilized in professional risk management to foster decision-making and crisis communication, higher education institutions frequently underutilize them. Traditional manual TTXs require excessive instructor facilitation, lack scalable assessment frameworks, and fail to generate objective interaction data. Consequently, educators face significant operational hurdles when attempting to scale experiential, team-based crisis management exercises across large cohorts while maintaining high fidelity and actionable learning evaluation.
Core Findings
To address scaling and assessment challenges, the authors evaluated the deployment of the web-based INJECT Exercise Platform (IXP). Across a two-year evaluation period from 2024 to 2026, the researchers conducted 25 technology-enhanced tabletop exercises involving 743 participants across university computing courses and extracurricular cybersecurity events. The platform automated scenario progression, facilitated structured digital team discussions, and logged granular telemetry to support data-driven automated evaluation. Methodologically, the study synthesizes interaction analytics and observational data into 24 concrete lessons learned. Findings demonstrate that technology-enhanced TTXs significantly decrease facilitator workload, improve student engagement and collaborative coordination, and offer educators transparent visibility into how student teams navigate information uncertainty and incident workflows.
Strategic Takeaway
For digital leaders and academic program directors, this research provides a validated framework for operationalizing computer-supported collaborative learning (CSCW) in crisis management training. By replacing manual facilitation with automated platform orchestration, organizations and universities can deploy scalable, repeatable decision-making simulations. Leaders can leverage the identified lessons to design socio-technical training environments that balance human collaboration with automated telemetry, yielding objective metrics on team adaptability, communication bottlenecks, and strategic decision velocity during critical cybersecurity incidents.