100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
At 00:01 on the first of the month, card payments at a 300-store pharmacy chain start failing. Tills show ‘connection error’ and the mobile app cannot place orders. Within twenty minutes the on-call engineer finds the cause: the TLS certificate on the internal payment gateway expired at midnight. Nobody knew it existed. The engineer who installed it left two years ago, and the renewal reminders went to his old mailbox. Issuing a new certificate needs approval from someone who is asleep. Stores open at 07:00. How do you fix it tonight, and how do you find the next one?
At 09:31 on the morning of a major interest-rate announcement, your online brokerage's order-entry service starts returning errors. Customers can log in and see positions but cannot place or cancel orders. Traffic is four times a normal day. A configuration change to the order-routing gateway went out at 08:50, and the network team is also seeing a surge from a few thousand IP addresses that could be a DDoS or could be your own customers' apps retrying. Customers with open positions are posting angrily on social media. Roll back, scale out or block traffic? You have one move to make first.