100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
Four days after you contained a ransomware attack and restored most systems from backup, a threat intelligence vendor emails your CISO a screenshot. Your company is listed on the group's leak site with a 72-hour countdown and a sample: forty scanned employee passports and a folder of customer contracts. The listing claims 600 GB was taken and will be published unless you pay $2.4 million. Your original investigation found no sign of data theft, and staff were told so. A trade reporter has already left a voicemail asking for comment. Do you engage, and what do you say?
A security researcher messages your support inbox with a link. On a criminal forum, someone is selling what they call your full customer database: 1.2 million rows with names, emails, password hashes and the last four digits of cards, for $8,000. The 20-row sample contains real customers, and one is a member of your own staff. Nothing in your logs points to a breach. An engineer remembers a copy of production restored onto a test server for a migration two years ago. The researcher plans to publish a blog post on Friday. Where do you start?
Your investigation confirms that an attacker had access to a customer support platform for 19 days. It held records for 210,000 people across the EU, the UK, California, Texas and Australia, and some records include government ID numbers. The company is listed in the US and provides services to several EU banks. Outside counsel joins at 10:00 and lays out at least five deadlines, some measured from 'awareness' and some from 'determination'. The board chair wants to know when this becomes public. When did each clock start, and what goes out first?
A security researcher emails your support address on a Friday afternoon. They have found a cloud storage bucket, publicly listable, that holds nightly CSV exports from your customer platform: names, email addresses, phone numbers and partial payment details for roughly 210,000 customers in the EU, UK and US. They attach a screenshot of the file list and say they will publish a write-up in seven days. Your cloud team confirms the bucket is yours and was made public eighteen months ago for a one-off analytics project. Access logging on it was never switched on.
A customer's security team calls your CISO at 07:30. Their EDR flagged your desktop agent, version 9.4.1, released nine days ago and signed with your code-signing certificate, making outbound connections to a domain registered last month. Your engineers confirm the binary contains code that is not in your repository. Telemetry says 3,100 customer organisations have installed 9.4.1, including hospitals and two government agencies. The customer says they will post their findings publicly at noon. Your auto-update service is still offering 9.4.1 right now.
Your help-desk software provider emails all customers at 18:00: an attacker accessed its production environment and "may have obtained" OAuth tokens that customers granted for integrations. Your instance has integrations with your CRM, your file-sharing platform and your code host, all granted with broad scopes two years ago by someone who has since left. The provider's notice gives no indicators, no timeline and a link to a status page. Your support team has 4,000 open tickets, many with customer attachments. The provider's account manager is not answering.
A threat-intelligence feed your team subscribes to posts a new entry: a ransomware group claims to have stolen 600 GB from a small order-fulfilment company. You use that company to ship orders, and you send it customer names, addresses, phone numbers and order contents every day. The listing includes a file tree with a folder named after your brand. The vendor has not contacted you. When you call, the owner says they "had a computer problem last week" and that their IT provider is handling it. You are the data controller for those customers.
You run a municipal water utility serving 38,000 people. At 11:05 an operator watches the cursor move across the SCADA screen on its own and raise the sodium hydroxide dosing setpoint from 90 to 5,400 parts per million. He resets it within a minute, and downstream pH alarms would have caught it before treated water reached a tap. The workstation runs remote-access software installed years ago so the on-call operator could work from home. The mayor’s office has already heard about it from a council member. Do you tell the public, and what do you say?
Police call your office manager at 06:30: a ground-floor window at your accounting firm’s branch office was smashed overnight. When staff arrive they find eleven laptops missing from desks, plus the small network storage box from the comms cupboard that the branch used for scanned client documents. IT believes the laptops are encrypted but is not sure about two older ones. Nobody knows exactly what was on the storage box or whether it was backed up. Tax season starts in three weeks. Is this a theft or a data breach?
A journalist emails your communications team at 16:10 on a Thursday. She has a screenshot of a leak-site post naming your 22-clinic outpatient group, with a sample file of 300 patient records: names, dates of birth, diagnoses and insurance numbers. The post claims 1.2 million records and gives you five days before full publication. Your security team has seen no ransomware and no obvious intrusion. The journalist wants comment by 18:00 and says two patients have already contacted her. You do not yet know whether the data is real, current or even yours. What happens before 18:00?
Your medical billing company, a business associate that processes claims for your 180-physician practice, sends a two-paragraph email: an unauthorised party accessed one of their file servers 'between March and June' and some of your patients may be affected. They found it 41 days ago. They have not said which patients, what data, or whether it was encrypted. Your compliance officer asks when your own 60-day clock started, and whether it started without you. Patients are calling the front desk after a local news story. What do you need from the vendor today, and who owns the answer?
Your company is six weeks from signing an agreement to buy a 300-person payments start-up. During security due diligence your team finds credentials for the target's production cloud account for sale on a criminal marketplace, dated four months ago. The founders say they had 'a minor incident' that was handled and that no notifications were needed. Their logs only go back 30 days. The deal team wants a recommendation this week: walk away, reprice, add protections in the agreement, or demand an independent investigation first.
A misconfigured analytics export at your online learning company exposed records for 640,000 students and staff in the EU, the UK, the United States, Canada and Australia. Fields include names, email addresses, dates of birth and, for 12,000 US users, partial payment data. You confirmed the exposure at 09:00 today. Each jurisdiction has different triggers, deadlines and regulators, and some of your customers are universities that are controllers in their own right. Counsel wants a single notification plan by end of day.