Event design

Keynote, workshop or incident-response tabletop?

Choose the working format before you choose the name on the program.

A keynote creates a shared starting point

Use a keynote when the goal is shared understanding, a memorable perspective or an opening to a larger conversation. Ask what the audience will understand differently when the session ends. A compelling talk is not a substitute for an implementation plan.

A workshop helps participants apply an idea

Choose a workshop when participants need time to discuss their circumstances, apply a method or practice a skill. Establish group size, facilitation, participant preparation and the output expected at the end. A session called a workshop may still be largely a presentation, so ask how time will be used.

A tabletop rehearses leadership decisions

An executive incident-response tabletop places participants in a hypothetical cyber incident. The purpose is to practice decisions, communication and coordination. It is preparation, not emergency incident-response support, a penetration test or a guarantee that a response plan will work.

• Define who should attend and which roles they will exercise.
• Agree on scenario boundaries and what organizational information can be used.
• Ask how observations will be recorded and who will receive them.
• Specify the debrief and any follow-up deliverable in the engagement scope.

Do not assume one format includes another

A keynote can precede a workshop or tabletop, but preparation, time and deliverables should be agreed separately. Confirm Q&A, materials, recording rights, travel and follow-up before contracting.

Confirm the delivery details

• Record the local timezone, session start, duration and Q&A allowance.
• Confirm venue or platform, microphones, screens, captions and accessible participation.
• Agree on a rehearsal window, arrival buffer, travel responsibility and day-of host role.
• Document recording rights, participant materials and follow-up scope separately.

Capture these details in your event brief. Mark unresolved items “To confirm” rather than assuming they are included.

Explore relevant expertise

Compare the speaker shortlist. Use the category notes to distinguish threat-awareness education, AI-system security and preparation exercises.

This guide provides organizer guidance, not a promise of any speaker’s deliverables.