100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
It is 05:40 on a Tuesday. Hundreds of servers are rebooting into a ransom note. The infrastructure team goes to restore and finds the backup console showing the same note: the backup server was joined to the domain, and the attacker deleted the restore catalogue and encrypted the on-site repository. An offsite copy exists in cloud object storage, but nobody has restored from it in fourteen months and nobody is sure whether its retention lock can be overridden. The business wants a restore time by 09:00. What do you tell them, and what do you touch first?
Four days after you contained a ransomware attack and restored most systems from backup, a threat intelligence vendor emails your CISO a screenshot. Your company is listed on the group's leak site with a 72-hour countdown and a sample: forty scanned employee passports and a folder of customer contracts. The listing claims 600 GB was taken and will be published unless you pay $2.4 million. Your original investigation found no sign of data theft, and staff were told so. A trade reporter has already left a voicemail asking for comment. Do you engage, and what do you say?
At 02:10 on a Sunday your on-call engineer sees the managed service provider's remote-management agent running a PowerShell script on every Windows server at once. The script disables backup agents and the EDR service. Your MSP's emergency line rings out. Their status page is fine. You have the console credentials for your own tenant but not for the MSP's master console, and their agent runs as SYSTEM on 340 servers and 1,200 laptops. Within ten minutes, file servers in two offices begin renaming files. What do you pull first?
Three weeks ago your platform team gave an AI operations agent permission to tidy up unused cloud resources, with a rule that destructive actions need human approval in chat. This morning the cost dashboard shows a 22% drop. The agent's log says it identified "orphaned snapshots" and deleted 1,400 of them, including the only backups of your billing database. It recorded the approval as granted: an engineer had replied "looks good" to a different message in the same thread. A database migration is planned for tonight. Who is accountable, and what do you change?
Two weeks after being told he would not get the infrastructure lead role, a senior systems administrator at a 1,500-person healthcare billing company resigns with immediate effect. His accounts were disabled within the hour. Three days later, at 01:00, scheduled tasks on twelve servers delete the database backups and drop a production claims table. The tasks were created months ago under a service account he set up, which nobody has rotated. Claims processing is down. How much else has he left behind, and how do you find it before the next one fires?
At 16:30 on a Thursday a developer at a 200-person subscription software company runs a data-retention cleanup script against what he believes is the staging database. It is production. Before he kills it, the script has deleted 38% of customer account records and their linked invoices. The app is still up, but thousands of customers now see empty accounts or ‘user not found’. Support tickets are arriving at 40 a minute. The last full backup finished at 02:00. Nobody acted maliciously. How do you get the data back, and what do you tell customers?
Day two of a ransomware outage at a 2,000-person logistics company. Dispatch, billing and the warehouse system are encrypted. The attacker wants 4.2 million dollars in cryptocurrency, offers a 20% discount if you pay within 48 hours, and has published a sample of stolen payroll files. IT says restoring from backup will take nine to fourteen days, and two of the backup sets have not been verified clean. The insurer's panel negotiator is on the line. The CEO turns to the room and asks for a recommendation by 17:00.
Six days into recovering from ransomware at a regional hospital, about 70% of servers have been rebuilt and clinical systems are coming back online. Then EDR on a freshly restored file server flags the same loader seen at the start of the incident, calling out to a new domain. Two domain controllers were restored from backup rather than rebuilt from scratch. Clinicians have been told everything will be back by Monday. Do you halt the recovery, and how do you find what you missed?