100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
A security researcher messages your support inbox with a link. On a criminal forum, someone is selling what they call your full customer database: 1.2 million rows with names, emails, password hashes and the last four digits of cards, for $8,000. The 20-row sample contains real customers, and one is a member of your own staff. Nothing in your logs points to a breach. An engineer remembers a copy of production restored onto a test server for a migration two years ago. The researcher plans to publish a blog post on Friday. Where do you start?
An HR coordinator meant to email a salary review spreadsheet to the payroll provider. Autocomplete picked a similar name at a recruitment agency instead. The file holds names, salaries, home addresses and sickness absence notes for 340 employees. An hour later the recipient replied: 'I think this was meant for someone else.' The coordinator is panicking and has asked a friend in IT to 'just recall it'. It is now 16:30 on a Thursday. What happens next, and who needs to know?
A regional HR manager reports on Monday morning that she left her laptop in an airport security tray on Friday evening. She waited because she hoped the airport would find it. The device management console shows it last checked in on Saturday at 09:12 from an unknown home network. Disk encryption shows 'pending' because a policy change was never completed on her model. The laptop held disciplinary files and a local copy of an investigation into a senior manager. What do you do first, and is this a notifiable breach?
A senior account executive resigned on Friday and joins a direct competitor in two weeks. On Monday, a data loss alert shows she synced 4,000 files to a personal cloud account over the weekend, including a full CRM export, pricing models and the customer contract folder. She is on garden leave but still has a working laptop and VPN access. Her manager insists she is trustworthy and that this is 'just her portfolio'. Legal wants to act before anything reaches the competitor. What do you do, and in what order?
Your investigation confirms that an attacker had access to a customer support platform for 19 days. It held records for 210,000 people across the EU, the UK, California, Texas and Australia, and some records include government ID numbers. The company is listed in the US and provides services to several EU banks. Outside counsel joins at 10:00 and lays out at least five deadlines, some measured from 'awareness' and some from 'determination'. The board chair wants to know when this becomes public. When did each clock start, and what goes out first?
A journalist emails your communications team at 16:10 on a Thursday. She has a screenshot of a leak-site post naming your 22-clinic outpatient group, with a sample file of 300 patient records: names, dates of birth, diagnoses and insurance numbers. The post claims 1.2 million records and gives you five days before full publication. Your security team has seen no ransomware and no obvious intrusion. The journalist wants comment by 18:00 and says two patients have already contacted her. You do not yet know whether the data is real, current or even yours. What happens before 18:00?
A parent forwards your district office an email from someone claiming to hold the records of every student in your 14-school district: names, addresses, grades, special-education plans and medical notes. Attached is a spreadsheet with her own child's details, correct as of last month. Your student information system is hosted by a vendor, and their support desk says they are 'looking into an incident affecting several customers'. The superintendent has a school board meeting tonight, and the local parents' group online already has 200 comments. What do you tell parents before the meeting?
A federal research sponsor's security office calls your university: data from a funded propulsion project has appeared on a foreign technical forum, including test results that were only ever stored on a lab's shared drive and one researcher's cloud storage account. Central IT has never managed that lab's servers. A postdoc's account shows logins from two countries within the same hour, repeatedly, over six months. The principal investigator says the lab follows every rule. Some of the data may be export-controlled, and the contract has a 72-hour cyber-incident reporting clause. When did that clock start?
You are a listed software company. On Monday the security team confirmed that an attacker took source code and a database of 1.1 million customer contact records through a compromised build server. Revenue impact is unclear, and two large customers have asked whether their API keys were exposed. The disclosure committee meets Wednesday morning. Once you determine the incident is material, you have four business days to file. Some in the room want to wait for the forensic report due in three weeks. Others think the decision is already overdue.
A misconfigured analytics export at your online learning company exposed records for 640,000 students and staff in the EU, the UK, the United States, Canada and Australia. Fields include names, email addresses, dates of birth and, for 12,000 US users, partial payment data. You confirmed the exposure at 09:00 today. Each jurisdiction has different triggers, deadlines and regulators, and some of your customers are universities that are controllers in their own right. Counsel wants a single notification plan by end of day.
A security researcher posted on social media that your insurance comparison site had left a storage bucket of 80,000 quote applications open to the internet. You closed it within an hour and decided, after a quick assessment, that it did not need to be notified. Eleven days later a letter arrives from the data protection authority. It asks when you became aware, who accessed the data, why you did not notify, and for a copy of your breach register entry. Replies are due in 14 days. Your breach register entry is two lines long.
Your accounting software company refused a ransom demand last week after a data theft. This morning hundreds of your small-business customers received an email from the attacker. It quotes each customer's own invoice data as proof, says you 'chose not to protect them', and invites them to pay 500 dollars each to have their records deleted. Support has 900 tickets in the queue. Two customers have posted the email on social media, and one says they have already paid.