100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
At 22:47 a payables clerk receives 31 MFA push requests in eight minutes. On the 32nd, half asleep, she taps Approve. By the time she reports it next morning, the account has signed in from a hosting provider, registered a new MFA device and created an inbox rule that moves any email containing 'invoice' or 'payment' to an obscure folder. Two supplier payment runs are scheduled for 11:00 today. Your SOC saw the overnight push alert and closed it as user error. What do you do before 11:00?
The finance team forwards a billing alert at 08:15: your cloud spend for the last 24 hours is $182,400 against a usual $3,000. The cloud team finds hundreds of large GPU instances running in four regions you have never used. They were launched from the root account of a development tenancy that nobody has logged into for a year. Its recovery email points to a former employee's personal address. Your provider's support line says a credit "may be considered" once you secure the account. The instances are still running and costing roughly $7,500 an hour.
At 19:45 on a Friday your company’s main social media account, with 450,000 followers, posts a video of your CEO announcing a giveaway: send cryptocurrency and receive double back. The video is a deepfake. Three more posts follow in ten minutes, and replies show customers who have already sent money. The social media manager is locked out because the account’s email and phone number have been changed. Nobody else knows who holds the recovery codes. The platform’s support form promises a reply within 48 hours. What do you do now?
It is Sunday morning at a regional bank with 600,000 retail customers. Fraud operations reports 1,400 instant payments in 18 hours from customer accounts to newly added payees, most just under the daily limit, about $3.1 million in total. Every payment passed one-time-passcode checks. Social media is filling with customers whose balances are zero, and the call-centre queue is 90 minutes. The digital banking team suspects SIM swaps or a phishing kit; nobody has confirmed either. Turning off instant payments to new payees stops the fraud, and it also stops legitimate rent and wage payments. Do you pull the switch?
Customer support at your 300-store grocery and pharmacy chain has logged 900 complaints in two days: loyalty points gone, redeemed for gift cards online and at self-checkout. Login traffic to the loyalty app is twelve times normal, mostly from residential proxy addresses, with a success rate of about 2%. That is roughly 18,000 accounts accessed. Points are not money in your accounts, but customers treat them as money, and the accounts also hold home addresses and pharmacy pickup history. Marketing launches a double-points promotion on Monday. What do you do first?