100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
It is day five after ransomware hit a 1,400-person insurance broker. Identity has been rebuilt and the attacker appears to be out. The infrastructure team can restore about twelve systems a day. Twenty-three business owners have each told the CEO their system is the most critical: claims, policy administration, finance, the broker portal, email archives. Two large clients threaten to move their accounts if the portal is not back by Monday. Yesterday a restored file server was found to contain the attacker's remote access tool and had to be taken down again. Who decides what comes back next, and on what basis?
At 07:30 on Monday the head of IT calls the CEO. Most office systems show a ransom note, email is down, and only the phones work. Staff are arriving and asking what to do. The note gives an email address and says the price doubles in 48 hours. Your cyber insurance policy sits in a shared folder that is now encrypted. Nobody is sure who should be in the room or who decides. In one hour the first customer calls will start. What happens in that hour?
A severe storm has hit the region served by a 1,200-person home insurer, and claims calls are at five times normal volume. At 08:20 the cloud contact-centre platform your agents use for calls, chat and call recording goes down across the provider’s entire region. The provider’s status page says ‘investigating’ and gives no estimate. Agents can still log into the claims system but cannot take calls. Customers with flooded homes are getting a dead line, and local radio has started asking why. Your contract’s service credit is worth one month’s fees. What is your plan for the next eight hours?
On Tuesday morning a post on a hacking forum claims to offer the ‘full database of a national pet-insurance company, 4 million customers’ and shares a 200-row sample. Within two hours it is on social media, a tech news site asks for comment, and your share price falls 6% at the open. Your security team checks the sample: the rows are real customers, but the fields match an old marketing list a former partner held, not your systems. Your logs show no intrusion so far. Customers are calling to cancel. How sure do you need to be before you say ‘we were not breached’?
A journalist emails your communications team at 16:10 on a Thursday. She has a screenshot of a leak-site post naming your 22-clinic outpatient group, with a sample file of 300 patient records: names, dates of birth, diagnoses and insurance numbers. The post claims 1.2 million records and gives you five days before full publication. Your security team has seen no ransomware and no obvious intrusion. The journalist wants comment by 18:00 and says two patients have already contacted her. You do not yet know whether the data is real, current or even yours. What happens before 18:00?
Your food-packaging plant runs three shifts and produces about $95,000 of product an hour. At 10:00 the SOC confirms ransomware on the corporate network and finds the same malware on one engineering workstation that can reach the lines' controllers. The lines are running normally. Isolating the plant network means losing the production schedule and batch records held in IT systems and running on paper at reduced output. A full shutdown is safest and costs more every hour. A major customer's promotion depends on next week's shipments. The board chair wants options and numbers by 13:00.
Day two of a ransomware outage at a 2,000-person logistics company. Dispatch, billing and the warehouse system are encrypted. The attacker wants 4.2 million dollars in cryptocurrency, offers a 20% discount if you pay within 48 hours, and has published a sample of stolen payroll files. IT says restoring from backup will take nine to fourteen days, and two of the backup sets have not been verified clean. The insurer's panel negotiator is on the line. The CEO turns to the room and asks for a recommendation by 17:00.
Three weeks after a ransomware attack, your company has spent 1.8 million on forensics, overtime and lost revenue. The insurer's coverage letter arrives. It reserves its rights and cites two problems. The application you signed last year stated that multi-factor authentication was enforced for all remote access, but the attacker came in through a legacy VPN account without it. And a war and state-actor exclusion may apply, because a government advisory linked the ransomware group to a hostile state. Finance needs to know what to book this quarter.
A security researcher posted on social media that your insurance comparison site had left a storage bucket of 80,000 quote applications open to the internet. You closed it within an hour and decided, after a quick assessment, that it did not need to be notified. Eleven days later a letter arrives from the data protection authority. It asks when you became aware, who accessed the data, why you did not notify, and for a copy of your breach register entry. Replies are due in 14 days. Your breach register entry is two lines long.