100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
A security researcher messages your support inbox with a link. On a criminal forum, someone is selling what they call your full customer database: 1.2 million rows with names, emails, password hashes and the last four digits of cards, for $8,000. The 20-row sample contains real customers, and one is a member of your own staff. Nothing in your logs points to a breach. An engineer remembers a copy of production restored onto a test server for a migration two years ago. The researcher plans to publish a blog post on Friday. Where do you start?
It is 10:40 on a Tuesday. A secret-scanning service emails your security inbox: a long-lived access key for your production deployment account was pushed to a public code repository 47 minutes ago, from a contractor's personal fork. The key has administrator rights. Your cloud audit log shows calls made with that key in the last ten minutes from an address nobody recognises, and the release pipeline uses the same key for tonight's deploy. The contractor is not answering their phone. What do you do in the next fifteen minutes?
It is Sunday morning at a regional bank with 600,000 retail customers. Fraud operations reports 1,400 instant payments in 18 hours from customer accounts to newly added payees, most just under the daily limit, about $3.1 million in total. Every payment passed one-time-passcode checks. Social media is filling with customers whose balances are zero, and the call-centre queue is 90 minutes. The digital banking team suspects SIM swaps or a phishing kit; nobody has confirmed either. Turning off instant payments to new payees stops the fraud, and it also stops legitimate rent and wage payments. Do you pull the switch?
A government agency privately tells your aerospace components firm that an intruder linked to a foreign intelligence service has been in your engineering network for about eight months. They share three indicators and ask you not to tip off the attacker. Your logs go back 90 days. The intruder appears to use legitimate admin tools rather than malware. Your largest customer is a defence prime with contractual reporting duties. Do you watch, or evict? And what do you tell anyone?