100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
Your investigation confirms that an attacker had access to a customer support platform for 19 days. It held records for 210,000 people across the EU, the UK, California, Texas and Australia, and some records include government ID numbers. The company is listed in the US and provides services to several EU banks. Outside counsel joins at 10:00 and lays out at least five deadlines, some measured from 'awareness' and some from 'determination'. The board chair wants to know when this becomes public. When did each clock start, and what goes out first?
At 07:15 on a Tuesday, your EU payment institution loses its core transaction database after a fault at the cloud provider that hosts it. Card authorisations are failing for about 40% of merchants across four member states. The provider's status page says 'degraded performance' and gives no estimate. By 09:00 your service desk has logged 2,300 merchant complaints. Your head of compliance asks the question nobody has answered yet: is this a major ICT-related incident under DORA, and if so, when did the clock start? The CEO wants to know what goes to the regulator, and when.