100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
Your project-management SaaS has been degraded for six hours. Officially the cause is 'database performance'. In reality the security team took two clusters offline after finding an attacker's web shell on an API server, and nobody yet knows whether customer data was accessed. The public status page still shows a yellow 'degraded' banner. Enterprise customers are asking about SLA credits, two have asked outright whether this is a security incident, and one has a contractual 48-hour breach-notice clause. Sales wants the status page to say 'scheduled maintenance'. What does the status page say now?