100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
Your accounts payable team receives an email from your largest packaging supplier, sent from their real address and replying to a genuine invoice thread. It says they have changed banks after an audit and attaches a signed letter with new account details. The clerk calls the number on the letter, gets a confirmation, updates the vendor record and pays $186,000 on Tuesday. On Friday the supplier's credit controller phones to ask why the invoice is overdue. Your bank says the receiving account is at another bank, which has not replied. What happens in the next hour?
Three customers call within a day to say they paid your invoices to new bank details your accounts receivable team emailed them. The emails came from your real billing mailbox, sat inside genuine threads and used your invoice template. Logs show the mailbox has been accessed from overseas for 26 days through a legacy mail protocol that skips MFA. Losses so far total $430,000 across three customers, and the mailbox holds 2,100 customer contacts. Customers want to know who is liable. Your general counsel asks: must we warn all 2,100 today?