100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
The group financial controller takes a call from what sounds exactly like the CEO, who is travelling. He says a confidential acquisition must close today, the lawyers will email instructions, and nobody else can know yet. Minutes later an email arrives from an outside law firm with wire details for €1.9 million and a signed letter of intent. The controller is uneasy and calls the CEO's mobile, which goes to voicemail. A voice note then arrives from an unknown number, in the CEO's voice, repeating the request. The bank cut-off is in 45 minutes. What should happen?
On Monday a finance manager joined a video call with what looked and sounded like your CEO and CFO, plus an "external lawyer". They explained a confidential acquisition and asked for three urgent payments to an escrow account, totalling $2.4 million. The manager made the payments after a follow-up email from the CEO's real address, sent through a compromised mail rule. Today the real CEO asks why finance moved money on a deal that does not exist. Your bank says the first transfer has left the receiving bank. The finance manager is distraught.
At 19:45 on a Friday your company’s main social media account, with 450,000 followers, posts a video of your CEO announcing a giveaway: send cryptocurrency and receive double back. The video is a deepfake. Three more posts follow in ten minutes, and replies show customers who have already sent money. The social media manager is locked out because the account’s email and phone number have been changed. Nobody else knows who holds the recovery codes. The platform’s support form promises a reply within 48 hours. What do you do now?
Two days before a municipal election, a 40-second audio clip spreads on social media. It sounds like your county's chief election official telling a colleague that ballots from two precincts 'will be handled differently this year'. A second post, styled like your website, says three polling places have moved. Your official never said this, and nothing has moved. By noon the clip has 300,000 plays, your phone lines are jammed, and a candidate is demanding an explanation. Your public results website is also seeing unusual traffic. How do you respond without amplifying the fake?