100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
A security researcher emails your support address on a Friday afternoon. They have found a cloud storage bucket, publicly listable, that holds nightly CSV exports from your customer platform: names, email addresses, phone numbers and partial payment details for roughly 210,000 customers in the EU, UK and US. They attach a screenshot of the file list and say they will publish a write-up in seven days. Your cloud team confirms the bucket is yours and was made public eighteen months ago for a one-off analytics project. Access logging on it was never switched on.
Police call your office manager at 06:30: a ground-floor window at your accounting firm’s branch office was smashed overnight. When staff arrive they find eleven laptops missing from desks, plus the small network storage box from the comms cupboard that the branch used for scanned client documents. IT believes the laptops are encrypted but is not sure about two older ones. Nobody knows exactly what was on the storage box or whether it was backed up. Tax season starts in three weeks. Is this a theft or a data breach?
Your medical billing company, a business associate that processes claims for your 180-physician practice, sends a two-paragraph email: an unauthorised party accessed one of their file servers 'between March and June' and some of your patients may be affected. They found it 41 days ago. They have not said which patients, what data, or whether it was encrypted. Your compliance officer asks when your own 60-day clock started, and whether it started without you. Patients are calling the front desk after a local news story. What do you need from the vendor today, and who owns the answer?