100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
At 14:10 your SOC sees a new federated domain added to your cloud identity tenant, then a conditional access policy disabled. Both changes came from a Global Admin account belonging to a cloud engineer who is on holiday. Within twenty minutes, two new app registrations with mail-read permissions appear and three other admins report their MFA methods were changed. The attacker can now create users, issue tokens and read any mailbox. You are not sure which admin accounts are still yours. How do you take the tenant back without locking yourselves out?
At 22:47 a payables clerk receives 31 MFA push requests in eight minutes. On the 32nd, half asleep, she taps Approve. By the time she reports it next morning, the account has signed in from a hosting provider, registered a new MFA device and created an inbox rule that moves any email containing 'invoice' or 'payment' to an obscure folder. Two supplier payment runs are scheduled for 11:00 today. Your SOC saw the overnight push alert and closed it as user error. What do you do before 11:00?
The head of sales operations clicked a link to a shared proposal on Monday and signed in as usual, MFA and all. This morning your identity logs show her session in use from a hosting provider while she is also active from the office, with no new sign-in and no MFA prompt. Overnight the session read 900 emails, downloaded the pricing folder, exported contacts from the CRM through single sign-on and consented to a new mail app. The help desk reset her password an hour ago. The activity has not stopped. Why not, and what do you revoke?
On Tuesday afternoon, a caller claiming to be a regional sales director phones the IT help desk from a number that is not on file. He sounds stressed, says he has a new phone and is about to present to a major customer, and knows his employee ID and his manager's name. The agent resets his MFA and sends a temporary password. Ninety minutes later the real director, sitting in your office, gets a sign-in alert. Since then the account has opened the CRM and the shared drive for an acquisition project. What now, and how did this get through?
On payday, three employees tell HR they have not been paid. In each case the HR self-service portal shows their bank details were changed eight days ago, from a sign-in that passed MFA. One employee remembers clicking a 'benefits enrolment' link in an email. This month's payroll file has already gone to the bank. Two more employees' details changed yesterday, and next week's contractor run is being prepared now. The affected staff are upset and want to know when they will get their money. What do you do today?
Three customers call within a day to say they paid your invoices to new bank details your accounts receivable team emailed them. The emails came from your real billing mailbox, sat inside genuine threads and used your invoice template. Logs show the mailbox has been accessed from overseas for 26 days through a legacy mail protocol that skips MFA. Losses so far total $430,000 across three customers, and the mailbox holds 2,100 customer contacts. Customers want to know who is liable. Your general counsel asks: must we warn all 2,100 today?
Your EDR raises a medium-severity alert on a senior developer's laptop: an unsigned executable launched from the downloads folder, then deleted itself. The developer says they installed a "free licence key generator" for a design tool on Saturday. It is now Monday. Since Saturday, their code-hosting session, their cloud console session and their password manager browser extension have all been used from an IP address in another country, with no multi-factor prompts, because the attacker replayed session cookies. The developer has admin rights on 60 repositories. Where do you start?
Customer support at your 300-store grocery and pharmacy chain has logged 900 complaints in two days: loyalty points gone, redeemed for gift cards online and at self-checkout. Login traffic to the loyalty app is twelve times normal, mostly from residential proxy addresses, with a success rate of about 2%. That is roughly 18,000 accounts accessed. Points are not money in your accounts, but customers treat them as money, and the accounts also hold home addresses and pharmacy pickup history. Marketing launches a double-points promotion on Monday. What do you do first?
Three weeks after a ransomware attack, your company has spent 1.8 million on forensics, overtime and lost revenue. The insurer's coverage letter arrives. It reserves its rights and cites two problems. The application you signed last year stated that multi-factor authentication was enforced for all remote access, but the attacker came in through a legacy VPN account without it. And a war and state-actor exclusion may apply, because a government advisory linked the ransomware group to a hostile state. Finance needs to know what to book this quarter.
At 02:15 a help-desk agent reset MFA for a cloud administrator after a convincing phone call. By 03:00 the attacker had registered a new device, created an access key in your production cloud account and disabled two logging trails. By 05:30, 3 TB had left a storage bucket holding customer documents. Your SOC sees an impossible-travel alert at 07:50. The identity, cloud and data teams each hold part of the picture, and each believes someone else is containing it.