100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
It is Wednesday morning and 2,600 staff are due to be paid on Friday. Your outsourced payroll provider has been offline since last night. Its status page says "investigating a security incident affecting some systems" and gives no recovery time. Your payroll team cannot submit the final run, and the provider has the only copy of this month's calculated pay, tax and deductions. Social media already has posts from employees at other companies using the same provider. Your union representative has asked HR whether pay will arrive on time. The CEO wants a decision by noon.
A severe storm has hit the region served by a 1,200-person home insurer, and claims calls are at five times normal volume. At 08:20 the cloud contact-centre platform your agents use for calls, chat and call recording goes down across the provider’s entire region. The provider’s status page says ‘investigating’ and gives no estimate. Agents can still log into the claims system but cannot take calls. Customers with flooded homes are getting a dead line, and local radio has started asking why. Your contract’s service credit is worth one month’s fees. What is your plan for the next eight hours?