Inside the Tabletop: What an Airport OT Incident Taught Us About Command, Cost, and Chaos

The team behind and inside Level Zero 2026's tabletop exercise breaks down what happened when an airport OT incident played out in real time. Derrik Oates and panelists from UPS, the Department of War, and the finance table walk through the ICS4ICS incident command framework, what it's like to be a first-timer when the pressure hits, why "keep your receipts" is real advice, and how to make sure exercise lessons actually change an organization. They also explain why the 2027 exercise becomes a dedicated full day.

Guests: Christian Harter (UPS); Donovan Tindill; Brad Willet (UPS); Daryl Haegley (United States Department of the Air Force) Host / moderator: Derrik Oates (UTSI)

Chapters: 00:00 Panel introductions 04:50 Why run tabletop exercises at all 08:48 The finance table: 'keep your receipts' 13:02 ICS4ICS sections and logistics 14:43 Decisions under fire 18:59 One voice: incident communications 20:46 Using the ICS4ICS framework anywhere 23:04 First-timer experience 27:45 Understand the problem before you fix it 30:30 Lessons learned and changes for 2027 35:20 Making lessons stick: ownership and after-action 40:56 Why practice matters: downtime and safety

Recorded at the CS²AI Online Symposium, "Level Zero: Visions & Reflections."

Join us at Level Zero 2027, April 23–30 at Georgia Tech in Atlanta: pre-conference training, the Conflag Zero™ tabletop exercise, and three days of practitioner-led sessions built so you can put what you learn to work the Monday you get back.

Questions: info@levelzeroconference.com

Sponsorship: sponsor@levelzeroconference.com

Produced by CS²AI (Control System Cyber Security Association International).