100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
A regional HR manager reports on Monday morning that she left her laptop in an airport security tray on Friday evening. She waited because she hoped the airport would find it. The device management console shows it last checked in on Saturday at 09:12 from an unknown home network. Disk encryption shows 'pending' because a policy change was never completed on her model. The laptop held disciplinary files and a local copy of an investigation into a senior manager. What do you do first, and is this a notifiable breach?
Your investigation confirms that an attacker had access to a customer support platform for 19 days. It held records for 210,000 people across the EU, the UK, California, Texas and Australia, and some records include government ID numbers. The company is listed in the US and provides services to several EU banks. Outside counsel joins at 10:00 and lays out at least five deadlines, some measured from 'awareness' and some from 'determination'. The board chair wants to know when this becomes public. When did each clock start, and what goes out first?
Your accounts payable team receives an email from your largest packaging supplier, sent from their real address and replying to a genuine invoice thread. It says they have changed banks after an audit and attaches a signed letter with new account details. The clerk calls the number on the letter, gets a confirmation, updates the vendor record and pays $186,000 on Tuesday. On Friday the supplier's credit controller phones to ask why the invoice is overdue. Your bank says the receiving account is at another bank, which has not replied. What happens in the next hour?
The group financial controller takes a call from what sounds exactly like the CEO, who is travelling. He says a confidential acquisition must close today, the lawyers will email instructions, and nobody else can know yet. Minutes later an email arrives from an outside law firm with wire details for €1.9 million and a signed letter of intent. The controller is uneasy and calls the CEO's mobile, which goes to voicemail. A voice note then arrives from an unknown number, in the CEO's voice, repeating the request. The bank cut-off is in 45 minutes. What should happen?
On payday, three employees tell HR they have not been paid. In each case the HR self-service portal shows their bank details were changed eight days ago, from a sign-in that passed MFA. One employee remembers clicking a 'benefits enrolment' link in an email. This month's payroll file has already gone to the bank. Two more employees' details changed yesterday, and next week's contractor run is being prepared now. The affected staff are upset and want to know when they will get their money. What do you do today?
Three customers call within a day to say they paid your invoices to new bank details your accounts receivable team emailed them. The emails came from your real billing mailbox, sat inside genuine threads and used your invoice template. Logs show the mailbox has been accessed from overseas for 26 days through a legacy mail protocol that skips MFA. Losses so far total $430,000 across three customers, and the mailbox holds 2,100 customer contacts. Customers want to know who is liable. Your general counsel asks: must we warn all 2,100 today?
Your EDR raises a medium-severity alert on a senior developer's laptop: an unsigned executable launched from the downloads folder, then deleted itself. The developer says they installed a "free licence key generator" for a design tool on Saturday. It is now Monday. Since Saturday, their code-hosting session, their cloud console session and their password manager browser extension have all been used from an IP address in another country, with no multi-factor prompts, because the attacker replayed session cookies. The developer has admin rights on 60 repositories. Where do you start?
On Monday a finance manager joined a video call with what looked and sounded like your CEO and CFO, plus an "external lawyer". They explained a confidential acquisition and asked for three urgent payments to an escrow account, totalling $2.4 million. The manager made the payments after a follow-up email from the CEO's real address, sent through a compromised mail rule. Today the real CEO asks why finance moved money on a deal that does not exist. Your bank says the first transfer has left the receiving bank. The finance manager is distraught.
Your filling-machine supplier emails every customer on a Thursday afternoon: an attacker had access to its remote-support platform for at least three weeks and 'may have used customer connections'. Your beverage plant gives this supplier always-on remote access to the line controllers so it can tune machines without a site visit. Your firewall shows sessions from the supplier's platform on four evenings when the supplier says no engineer was working. Its account manager wants the connection left open because a firmware fix is scheduled for Monday. Do you cut them off, and what do you look at first?
At 19:45 on a Friday your company’s main social media account, with 450,000 followers, posts a video of your CEO announcing a giveaway: send cryptocurrency and receive double back. The video is a deepfake. Three more posts follow in ten minutes, and replies show customers who have already sent money. The social media manager is locked out because the account’s email and phone number have been changed. Nobody else knows who holds the recovery codes. The platform’s support form promises a reply within 48 hours. What do you do now?
Three weeks after a ransomware attack, your company has spent 1.8 million on forensics, overtime and lost revenue. The insurer's coverage letter arrives. It reserves its rights and cites two problems. The application you signed last year stated that multi-factor authentication was enforced for all remote access, but the attacker came in through a legacy VPN account without it. And a war and state-actor exclusion may apply, because a government advisory linked the ransomware group to a hostile state. Finance needs to know what to book this quarter.
A security researcher posted on social media that your insurance comparison site had left a storage bucket of 80,000 quote applications open to the internet. You closed it within an hour and decided, after a quick assessment, that it did not need to be notified. Eleven days later a letter arrives from the data protection authority. It asks when you became aware, who accessed the data, why you did not notify, and for a copy of your breach register entry. Replies are due in 14 days. Your breach register entry is two lines long.
You run IT for a mid-sized water utility in the EU, classed as an essential entity under NIS2. At 06:30 monitoring shows that the remote-access gateway used by contractors has been accepting logins from an unfamiliar country for two nights, and the telemetry server it reaches is behaving oddly. Nothing has failed, and operations say pumping is normal. The national CSIRT expects an early warning within 24 hours of becoming aware of a significant incident. Is this significant, when did the clock start, and who sends it?
At 10:20 your SOC escalates a confirmed business email compromise: an attacker in the CFO's mailbox has redirected a 1.3 million dollar supplier payment due to leave at 15:00. At 10:35 a second escalation: crypto-mining containers are running in production Kubernetes after a leaked deploy token, and the same token can push images. You have four incident responders, one of them on leave, and a retainer firm that can send two people tomorrow. Who works on what first?