100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
Three customers call within a day to say they paid your invoices to new bank details your accounts receivable team emailed them. The emails came from your real billing mailbox, sat inside genuine threads and used your invoice template. Logs show the mailbox has been accessed from overseas for 26 days through a legacy mail protocol that skips MFA. Losses so far total $430,000 across three customers, and the mailbox holds 2,100 customer contacts. Customers want to know who is liable. Your general counsel asks: must we warn all 2,100 today?
Three weeks after a ransomware attack, your company has spent 1.8 million on forensics, overtime and lost revenue. The insurer's coverage letter arrives. It reserves its rights and cites two problems. The application you signed last year stated that multi-factor authentication was enforced for all remote access, but the attacker came in through a legacy VPN account without it. And a war and state-actor exclusion may apply, because a government advisory linked the ransomware group to a hostile state. Finance needs to know what to book this quarter.