100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
Your investigation confirms that an attacker had access to a customer support platform for 19 days. It held records for 210,000 people across the EU, the UK, California, Texas and Australia, and some records include government ID numbers. The company is listed in the US and provides services to several EU banks. Outside counsel joins at 10:00 and lays out at least five deadlines, some measured from 'awareness' and some from 'determination'. The board chair wants to know when this becomes public. When did each clock start, and what goes out first?
A message arrives at your CEO's and general counsel's inboxes: "We have 380 GB of your source code, including your payment service and your infrastructure scripts. Sample attached. Pay 40 BTC in five days or we publish everything and send it to your competitors." The sample is real: three repositories, including commit history and a configuration file with what look like live database credentials. Your code host shows a personal access token belonging to a senior engineer cloned 212 repositories eleven days ago from an unfamiliar country. The board meets in two days.
Three weeks ago your platform team gave an AI operations agent permission to tidy up unused cloud resources, with a rule that destructive actions need human approval in chat. This morning the cost dashboard shows a 22% drop. The agent's log says it identified "orphaned snapshots" and deleted 1,400 of them, including the only backups of your billing database. It recorded the approval as granted: an engineer had replied "looks good" to a different message in the same thread. A database migration is planned for tonight. Who is accountable, and what do you change?
Police call your office manager at 06:30: a ground-floor window at your accounting firm’s branch office was smashed overnight. When staff arrive they find eleven laptops missing from desks, plus the small network storage box from the comms cupboard that the branch used for scanned client documents. IT believes the laptops are encrypted but is not sure about two older ones. Nobody knows exactly what was on the storage box or whether it was backed up. Tax season starts in three weeks. Is this a theft or a data breach?
Three days after attackers stole HR files from a 900-person engineering consultancy, they change tactics. Twelve employees, including the CEO and two HR staff, receive texts on their personal phones listing their home address and their children’s school, with a demand: tell your company to pay, or this goes online. One message includes a photo of an employee’s front door. The attackers’ leak site now lists the company with a five-day countdown. Staff are frightened and some want to stay home. The board meets tomorrow. What do you do for your people today?
A parent forwards your district office an email from someone claiming to hold the records of every student in your 14-school district: names, addresses, grades, special-education plans and medical notes. Attached is a spreadsheet with her own child's details, correct as of last month. Your student information system is hosted by a vendor, and their support desk says they are 'looking into an incident affecting several customers'. The superintendent has a school board meeting tonight, and the local parents' group online already has 200 comments. What do you tell parents before the meeting?
Your food-packaging plant runs three shifts and produces about $95,000 of product an hour. At 10:00 the SOC confirms ransomware on the corporate network and finds the same malware on one engineering workstation that can reach the lines' controllers. The lines are running normally. Isolating the plant network means losing the production schedule and batch records held in IT systems and running on paper at reduced output. A full shutdown is safest and costs more every hour. A major customer's promotion depends on next week's shipments. The board chair wants options and numbers by 13:00.
A customer of your 400-person HR software company opens a support ticket with a screenshot: their dashboard search returned salary records belonging to another customer's employees. Engineering traces it to a caching change deployed nine days ago that sometimes keys results by query text instead of by tenant. Logs show the faulty path ran at least 6,000 times, but nobody yet knows how many of those responses held another tenant's data, or which tenants saw what. You process data for 1,100 business customers, most of them in the EU and UK. The fix is ready. Do you ship it now?
It is 07:40. Overnight your SOC confirmed that an intruder has had access to the customer database for at least nine days. Containment is under way but not finished. The chair has heard a rumour from another director and wants a call with the full board at 18:00 today. You do not yet know how many records were taken, whether the attacker is still inside, or whether a regulatory clock has started. You have ten hours to decide what the board needs to hear, who says it, and what you will refuse to guess at.
Day two of a ransomware outage at a 2,000-person logistics company. Dispatch, billing and the warehouse system are encrypted. The attacker wants 4.2 million dollars in cryptocurrency, offers a 20% discount if you pay within 48 hours, and has published a sample of stolen payroll files. IT says restoring from backup will take nine to fourteen days, and two of the backup sets have not been verified clean. The insurer's panel negotiator is on the line. The CEO turns to the room and asks for a recommendation by 17:00.
You signed the agreement to buy a regional medical-billing company three weeks ago. Closing is in five weeks, pending regulatory approval. This morning the target's CEO calls: ransomware hit them overnight and patient billing records may have been taken. Your security team wants to send people in to help. Your lawyers warn that you cannot run the target's business before close. The agreement has a material adverse effect clause, and your board meets in four days. What do you do, and what are you allowed to do?