100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
A parent forwards your district office an email from someone claiming to hold the records of every student in your 14-school district: names, addresses, grades, special-education plans and medical notes. Attached is a spreadsheet with her own child's details, correct as of last month. Your student information system is hosted by a vendor, and their support desk says they are 'looking into an incident affecting several customers'. The superintendent has a school board meeting tonight, and the local parents' group online already has 200 comments. What do you tell parents before the meeting?
A federal research sponsor's security office calls your university: data from a funded propulsion project has appeared on a foreign technical forum, including test results that were only ever stored on a lab's shared drive and one researcher's cloud storage account. Central IT has never managed that lab's servers. A postdoc's account shows logins from two countries within the same hour, repeatedly, over six months. The principal investigator says the lab follows every rule. Some of the data may be export-controlled, and the contract has a 72-hour cyber-incident reporting clause. When did that clock start?
A misconfigured analytics export at your online learning company exposed records for 640,000 students and staff in the EU, the UK, the United States, Canada and Australia. Fields include names, email addresses, dates of birth and, for 12,000 US users, partial payment data. You confirmed the exposure at 09:00 today. Each jurisdiction has different triggers, deadlines and regulators, and some of your customers are universities that are controllers in their own right. Counsel wants a single notification plan by end of day.