100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
At 07:30 on Monday the head of IT calls the CEO. Most office systems show a ransom note, email is down, and only the phones work. Staff are arriving and asking what to do. The note gives an email address and says the price doubles in 48 hours. Your cyber insurance policy sits in a shared folder that is now encrypted. Nobody is sure who should be in the room or who decides. In one hour the first customer calls will start. What happens in that hour?
Your food-packaging plant runs three shifts and produces about $95,000 of product an hour. At 10:00 the SOC confirms ransomware on the corporate network and finds the same malware on one engineering workstation that can reach the lines' controllers. The lines are running normally. Isolating the plant network means losing the production schedule and batch records held in IT systems and running on paper at reduced output. A full shutdown is safest and costs more every hour. A major customer's promotion depends on next week's shipments. The board chair wants options and numbers by 13:00.
Day two of a ransomware outage at a 2,000-person logistics company. Dispatch, billing and the warehouse system are encrypted. The attacker wants 4.2 million dollars in cryptocurrency, offers a 20% discount if you pay within 48 hours, and has published a sample of stolen payroll files. IT says restoring from backup will take nine to fourteen days, and two of the backup sets have not been verified clean. The insurer's panel negotiator is on the line. The CEO turns to the room and asks for a recommendation by 17:00.
Three weeks after a ransomware attack, your company has spent 1.8 million on forensics, overtime and lost revenue. The insurer's coverage letter arrives. It reserves its rights and cites two problems. The application you signed last year stated that multi-factor authentication was enforced for all remote access, but the attacker came in through a legacy VPN account without it. And a war and state-actor exclusion may apply, because a government advisory linked the ransomware group to a hostile state. Finance needs to know what to book this quarter.