The empty chair: Guess who’s missing from your cybersecurity tabletop exercise