100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
Four days after you contained a ransomware attack and restored most systems from backup, a threat intelligence vendor emails your CISO a screenshot. Your company is listed on the group's leak site with a 72-hour countdown and a sample: forty scanned employee passports and a folder of customer contracts. The listing claims 600 GB was taken and will be published unless you pay $2.4 million. Your original investigation found no sign of data theft, and staff were told so. A trade reporter has already left a voicemail asking for comment. Do you engage, and what do you say?
It is day five after ransomware hit a 1,400-person insurance broker. Identity has been rebuilt and the attacker appears to be out. The infrastructure team can restore about twelve systems a day. Twenty-three business owners have each told the CEO their system is the most critical: claims, policy administration, finance, the broker portal, email archives. Two large clients threaten to move their accounts if the portal is not back by Monday. Yesterday a restored file server was found to contain the attacker's remote access tool and had to be taken down again. Who decides what comes back next, and on what basis?
Your platform team moved CI to keyless federated identity last quarter: pipelines exchange a signed token for a short-lived cloud deploy role. Tonight the SOC sees that role assumed 31 times in two hours. The token claims name a repository under an organisation you have never heard of. The trust policy, it turns out, checks the identity provider but not which organisation the token comes from. Using the role, someone has created two new identities, read your secrets store and changed a load balancer rule in production. Nothing has failed yet. Where do you cut, and what do you trust after?
A threat-intelligence feed your team subscribes to posts a new entry: a ransomware group claims to have stolen 600 GB from a small order-fulfilment company. You use that company to ship orders, and you send it customer names, addresses, phone numbers and order contents every day. The listing includes a file tree with a folder named after your brand. The vendor has not contacted you. When you call, the owner says they "had a computer problem last week" and that their IT provider is handling it. You are the data controller for those customers.
A national cyber agency publishes an alert on Thursday evening: a critical, unpatched flaw in the managed file-transfer appliance you use to exchange files with banks, insurers and two government departments is being exploited at scale. The alert lists a web-shell file name and asks organisations to check for it. Your appliance has that file, created four days ago. The appliance holds 30 days of transfers, including claims files with health information. The vendor says a patch is "coming within 48 hours". Your partners start emailing to ask whether you are affected.
Two weeks after being told he would not get the infrastructure lead role, a senior systems administrator at a 1,500-person healthcare billing company resigns with immediate effect. His accounts were disabled within the hour. Three days later, at 01:00, scheduled tasks on twelve servers delete the database backups and drop a production claims table. The tasks were created months ago under a service account he set up, which nobody has rotated. Claims processing is down. How much else has he left behind, and how do you find it before the next one fires?
Your threat-intelligence provider sends a screenshot from a criminal forum: a seller offers ‘VPN and Citrix access to a regional insurer, 2,000 staff, domain user, $6,000, insider can stay on for ongoing jobs’. The details match your company. The SOC traces two test logins described in the post to a claims handler’s account, from her home IP address, at times she was not scheduled to work. She is on shift right now. Is she the seller, a victim, or both? Do you lock her out now, or watch to see who buys?
A severe storm has hit the region served by a 1,200-person home insurer, and claims calls are at five times normal volume. At 08:20 the cloud contact-centre platform your agents use for calls, chat and call recording goes down across the provider’s entire region. The provider’s status page says ‘investigating’ and gives no estimate. Agents can still log into the claims system but cannot take calls. Customers with flooded homes are getting a dead line, and local radio has started asking why. Your contract’s service credit is worth one month’s fees. What is your plan for the next eight hours?
On Tuesday morning a post on a hacking forum claims to offer the ‘full database of a national pet-insurance company, 4 million customers’ and shares a 200-row sample. Within two hours it is on social media, a tech news site asks for comment, and your share price falls 6% at the open. Your security team checks the sample: the rows are real customers, but the fields match an old marketing list a former partner held, not your systems. Your logs show no intrusion so far. Customers are calling to cancel. How sure do you need to be before you say ‘we were not breached’?
A journalist emails your communications team at 16:10 on a Thursday. She has a screenshot of a leak-site post naming your 22-clinic outpatient group, with a sample file of 300 patient records: names, dates of birth, diagnoses and insurance numbers. The post claims 1.2 million records and gives you five days before full publication. Your security team has seen no ransomware and no obvious intrusion. The journalist wants comment by 18:00 and says two patients have already contacted her. You do not yet know whether the data is real, current or even yours. What happens before 18:00?
Your medical billing company, a business associate that processes claims for your 180-physician practice, sends a two-paragraph email: an unauthorised party accessed one of their file servers 'between March and June' and some of your patients may be affected. They found it 41 days ago. They have not said which patients, what data, or whether it was encrypted. Your compliance officer asks when your own 60-day clock started, and whether it started without you. Patients are calling the front desk after a local news story. What do you need from the vendor today, and who owns the answer?
Three weeks after a ransomware attack, your company has spent 1.8 million on forensics, overtime and lost revenue. The insurer's coverage letter arrives. It reserves its rights and cites two problems. The application you signed last year stated that multi-factor authentication was enforced for all remote access, but the attacker came in through a legacy VPN account without it. And a war and state-actor exclusion may apply, because a government advisory linked the ransomware group to a hostile state. Finance needs to know what to book this quarter.
Four days after you notified 210,000 customers that their names, addresses and loyalty account details were exposed, a plaintiffs' law firm publishes a press release saying it is investigating claims against your retail chain and inviting affected customers to get in touch. A demand letter citing a state privacy statute arrives the next day. Customer support is fielding calls asking whether people should join. Your forensic firm is still finishing its report. What gets written down now may be read in court later.