100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
Your investigation confirms that an attacker had access to a customer support platform for 19 days. It held records for 210,000 people across the EU, the UK, California, Texas and Australia, and some records include government ID numbers. The company is listed in the US and provides services to several EU banks. Outside counsel joins at 10:00 and lays out at least five deadlines, some measured from 'awareness' and some from 'determination'. The board chair wants to know when this becomes public. When did each clock start, and what goes out first?
A misconfigured analytics export at your online learning company exposed records for 640,000 students and staff in the EU, the UK, the United States, Canada and Australia. Fields include names, email addresses, dates of birth and, for 12,000 US users, partial payment data. You confirmed the exposure at 09:00 today. Each jurisdiction has different triggers, deadlines and regulators, and some of your customers are universities that are controllers in their own right. Counsel wants a single notification plan by end of day.