Tabletop Copilot

• 

Inspiration

What inspired us most was the realization that tools like MeDo are changing who can build software.

A few years ago, turning a rough product idea into a deployed web app with a real workflow, backend data, structured UI, and a usable demo would have required a full engineering team. With MeDo, the distance between an idea and a working product became much shorter. It showed us that a person with a strong problem, good source material, and a clear product direction can now build something that feels close to a real customer-facing service.

We wanted to test that idea in a serious domain: cybersecurity readiness.

CISA and NCSC already publish excellent public materials for incident response and tabletop exercises. But for many small SaaS teams, these materials remain static documents. Someone still has to interpret the guidance, tailor it to the organization, assign roles, facilitate the drill, capture decisions, identify gaps, and produce an after-action record.

Tabletop Copilot was inspired by that gap. We wanted to use MeDo to turn trusted public cyber guidance into a live, role-based incident response drill that a small team could actually run.

What It Does

Tabletop Copilot helps organizations run self-guided cyber incident tabletop exercises.

A user enters company context, selects exercise participants, chooses an incident drill, and then moves through staged scenario injects. At each stage, the app asks decision questions, captures the team’s response, and provides source-based facilitator feedback.

The app identifies strengths, missing decisions, follow-up questions, likely consequences, and suggested action items. At the end, it generates an evidence pack that includes the exercise timeline, participants, decision log, gaps, improvement actions, source basis, and disclaimer.

The goal is not to replace official compliance training, legal advice, or regulator-approved exercises. The goal is to help teams practice incident response and document what they learned.

How We Built It With MeDo

We used MeDo as the main product builder for the project.

We started by describing the product vision in natural language: a web app that turns public CISA/NCSC-style tabletop guidance into a live drill room and evidence pack. From that, MeDo generated the initial app structure, including the landing page, company intake flow, participant setup, drill selection, drill room, feedback panel, and evidence pack experience.

We then iterated on the app through MeDo prompts. We refined the setup flow, improved the drill selection UX, added a recommended drills section, connected backend seed data, and adjusted the feedback experience so it felt like a facilitator rather than a simple checklist.

The final build includes:

• 43 drill packs
• 102 exercise stages
• 440 answer keys
• 1,778 rubric criteria
• source-based expected actions
• role-based drill flow
• immediate facilitator feedback
• evidence pack generation

MeDo helped us move quickly from concept to a deployed, interactive product. Instead of spending the whole hackathon on scaffolding, routing, and basic UI wiring, we were able to focus on the product logic, source data, evaluation structure, and demo experience.

Challenges

The biggest challenge was turning static public guidance into something interactive.

CISA and NCSC materials are useful, but they are not always structured like app data. They do not simply provide a clean list of questions, answers, rubrics, and UI-ready scenarios. We had to transform the material into drill packs, stages, decision questions, scenario injects, expected actions, answer keys, and rubric criteria.

Another challenge was evaluation. A tabletop drill should not feel like a multiple-choice quiz. Users answer in free text, and different teams may express the same decision in different ways. To make feedback useful, we structured the app around source-based expected actions and rubric criteria, while still allowing LLM-enhanced feedback when available.

We also had to make the app reliable for a public demo. If an LLM call fails or takes too long, the app still needs to provide useful fallback feedback. That pushed us to design the evaluation flow so that the experience does not depend entirely on one model response.

What We Learned

We learned that AI app builders are most powerful when they are paired with clear product thinking.

MeDo can quickly create the structure of a working app, but the quality of the result depends on how clearly the product is defined: who it serves, what problem it solves, what the main workflow is, and what must not be overbuilt.

We also learned that LLMs are not the whole product. For a serious workflow like incident response training, the app needs trusted source data, structured rubrics, fallback behavior, citations, and a final artifact that users can keep. The LLM can improve the flexibility and tone of feedback, but the product needs a reliable foundation underneath it.

Most importantly, we learned that tools like MeDo make it possible for more people to build useful software from a strong idea. That does not remove the need for judgment, domain understanding, or careful iteration, but it dramatically lowers the barrier between imagining a service and putting a working version in front of users.

Accomplishments

We are proud that Tabletop Copilot became more than a single hardcoded demo scenario.

The submitted build includes a seeded drill library with dozens of exercises, stage-based scenario data, answer keys, and rubric criteria. A user can go from landing page to company setup, participant selection, drill selection, live decision-making, facilitator feedback, and evidence pack generation.

We are especially proud of the source-based feedback loop. The app does not just say whether an answer is “good” or “bad.” It identifies missing incident response decisions such as incident ownership, severity declaration, evidence preservation, containment scope, recovery planning, legal escalation, and post-exercise improvements.

What's Next

Next, we would improve PDF export, team collaboration, scheduled tabletop sessions, organization-specific playbook mapping, and deeper LLM-assisted facilitation.

We would also like to let organizations map drills to their own incident response plans, SOC 2 controls, ISO 27001 clauses, cyber insurance requirements, and customer security review evidence.

Long term, we see Tabletop Copilot as a way for small and mid-sized teams to practice crisis response before the real incident happens.

Built With

• cisa/ncsc-public-guidance
• evaluation
• llm-assisted
• medo
• react
• seeded-csv-data
• supabase-style-backend/database
• tailwind-css
• typescript