100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
Two weeks after being told he would not get the infrastructure lead role, a senior systems administrator at a 1,500-person healthcare billing company resigns with immediate effect. His accounts were disabled within the hour. Three days later, at 01:00, scheduled tasks on twelve servers delete the database backups and drop a production claims table. The tasks were created months ago under a service account he set up, which nobody has rotated. Claims processing is down. How much else has he left behind, and how do you find it before the next one fires?
Your medical billing company, a business associate that processes claims for your 180-physician practice, sends a two-paragraph email: an unauthorised party accessed one of their file servers 'between March and June' and some of your patients may be affected. They found it 41 days ago. They have not said which patients, what data, or whether it was encrypted. Your compliance officer asks when your own 60-day clock started, and whether it started without you. Patients are calling the front desk after a local news story. What do you need from the vendor today, and who owns the answer?
You signed the agreement to buy a regional medical-billing company three weeks ago. Closing is in five weeks, pending regulatory approval. This morning the target's CEO calls: ransomware hit them overnight and patient billing records may have been taken. Your security team wants to send people in to help. Your lawyers warn that you cannot run the target's business before close. The agreement has a material adverse effect clause, and your board meets in four days. What do you do, and what are you allowed to do?
Six days into recovering from ransomware at a regional hospital, about 70% of servers have been rebuilt and clinical systems are coming back online. Then EDR on a freshly restored file server flags the same loader seen at the start of the incident, calling out to a new domain. Two domain controllers were restored from backup rather than rebuilt from scratch. Clinicians have been told everything will be back by Monday. Do you halt the recovery, and how do you find what you missed?