100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
A customer's security team calls your CISO at 07:30. Their EDR flagged your desktop agent, version 9.4.1, released nine days ago and signed with your code-signing certificate, making outbound connections to a domain registered last month. Your engineers confirm the binary contains code that is not in your repository. Telemetry says 3,100 customer organisations have installed 9.4.1, including hospitals and two government agencies. The customer says they will post their findings publicly at noon. Your auto-update service is still offering 9.4.1 right now.
On Tuesday morning a post on a hacking forum claims to offer the ‘full database of a national pet-insurance company, 4 million customers’ and shares a 200-row sample. Within two hours it is on social media, a tech news site asks for comment, and your share price falls 6% at the open. Your security team checks the sample: the rows are real customers, but the fields match an old marketing list a former partner held, not your systems. Your logs show no intrusion so far. Customers are calling to cancel. How sure do you need to be before you say ‘we were not breached’?
Your project-management SaaS has been degraded for six hours. Officially the cause is 'database performance'. In reality the security team took two clusters offline after finding an attacker's web shell on an API server, and nobody yet knows whether customer data was accessed. The public status page still shows a yellow 'degraded' banner. Enterprise customers are asking about SLA credits, two have asked outright whether this is a security incident, and one has a contractual 48-hour breach-notice clause. Sales wants the status page to say 'scheduled maintenance'. What does the status page say now?
You are a listed software company. On Monday the security team confirmed that an attacker took source code and a database of 1.1 million customer contact records through a compromised build server. Revenue impact is unclear, and two large customers have asked whether their API keys were exposed. The disclosure committee meets Wednesday morning. Once you determine the incident is material, you have four business days to file. Some in the room want to wait for the forensic report due in three weeks. Others think the decision is already overdue.