100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
It is day five after ransomware hit a 1,400-person insurance broker. Identity has been rebuilt and the attacker appears to be out. The infrastructure team can restore about twelve systems a day. Twenty-three business owners have each told the CEO their system is the most critical: claims, policy administration, finance, the broker portal, email archives. Two large clients threaten to move their accounts if the portal is not back by Monday. Yesterday a restored file server was found to contain the attacker's remote access tool and had to be taken down again. Who decides what comes back next, and on what basis?
On payday, three employees tell HR they have not been paid. In each case the HR self-service portal shows their bank details were changed eight days ago, from a sign-in that passed MFA. One employee remembers clicking a 'benefits enrolment' link in an email. This month's payroll file has already gone to the bank. Two more employees' details changed yesterday, and next week's contractor run is being prepared now. The affected staff are upset and want to know when they will get their money. What do you do today?
At 07:10 customers of a 700-person online bank start reporting that the login page looks slightly wrong and asks for their one-time passcode twice. Your engineers find the domain’s name servers were changed overnight through the registrar’s web portal, using a staff account protected only by a password and SMS codes. DNS now points to attacker-controlled servers, and a certificate for your login hostname was issued to someone else at 03:40. Some resolvers still have the old records cached. The registrar’s support line opens at 09:00. How do you take your domain back, and what do you tell customers?
Monday, 07:30. Staff at a county council serving 280,000 residents arrive to find file shares encrypted and the housing benefits, social care case management and parking systems unavailable. Phones still work, but the contact centre cannot see case records. A social worker needs a child's safeguarding history for an emergency court hearing at 11:00. The ransom note demands payment within 72 hours and threatens to publish residents' data. Councillors are already asking questions, and a local reporter has heard that the payments portal is down. What do you prioritise this morning?
Accounts payable at your industrial equipment manufacturer pays $860,000 to a long-standing steel supplier, and three days later the supplier asks where its money is. The bank details on file were changed through your supplier self-service portal two weeks ago, by a login using the supplier's own account. The same account uploaded six updated 'drawing packages' that your design engineers have since opened. Two other suppliers report odd password-reset emails from your portal. The portal is run by a SaaS vendor your procurement team chose. What do you check, freeze and tell suppliers today?