100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
A security researcher messages your support inbox with a link. On a criminal forum, someone is selling what they call your full customer database: 1.2 million rows with names, emails, password hashes and the last four digits of cards, for $8,000. The 20-row sample contains real customers, and one is a member of your own staff. Nothing in your logs points to a breach. An engineer remembers a copy of production restored onto a test server for a migration two years ago. The researcher plans to publish a blog post on Friday. Where do you start?
Customer support at your 300-store grocery and pharmacy chain has logged 900 complaints in two days: loyalty points gone, redeemed for gift cards online and at self-checkout. Login traffic to the loyalty app is twelve times normal, mostly from residential proxy addresses, with a success rate of about 2%. That is roughly 18,000 accounts accessed. Points are not money in your accounts, but customers treat them as money, and the accounts also hold home addresses and pharmacy pickup history. Marketing launches a double-points promotion on Monday. What do you do first?