100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
It is 23:15 on the Friday before a long weekend. The only on-call engineer gets an alert for mass file renames on a file server, then twelve more servers in five minutes. The SOC is outsourced: it has opened a ticket but cannot isolate hosts without written approval. The IT manager is on a flight until 06:00, the CISO is not answering, and the incident response retainer's hotline wants a contract number nobody on shift has. The attacker is still active. Who can authorise isolation right now, and what do you pull first?
At 02:10 on a Sunday your on-call engineer sees the managed service provider's remote-management agent running a PowerShell script on every Windows server at once. The script disables backup agents and the EDR service. Your MSP's emergency line rings out. Their status page is fine. You have the console credentials for your own tenant but not for the MSP's master console, and their agent runs as SYSTEM on 340 servers and 1,200 laptops. Within ten minutes, file servers in two offices begin renaming files. What do you pull first?
You run a municipal water utility serving 38,000 people. At 11:05 an operator watches the cursor move across the SCADA screen on its own and raise the sodium hydroxide dosing setpoint from 90 to 5,400 parts per million. He resets it within a minute, and downstream pH alarms would have caught it before treated water reached a tap. The workstation runs remote-access software installed years ago so the on-call operator could work from home. The mayor’s office has already heard about it from a council member. Do you tell the public, and what do you say?
A colocation provider’s night technician calls your on-call engineer at 22:40. He found a man in a high-visibility vest inside your company’s locked cage, holding a laptop with a cable plugged into a top-of-rack switch. The man said he was ‘from the network team’ and left before site security arrived. The front desk logged him following one of your contractors through the entry mantrap two hours earlier. Your cage hosts the card payment platform for 2 million customers. What do you check first, and who do you call?
At 00:01 on the first of the month, card payments at a 300-store pharmacy chain start failing. Tills show ‘connection error’ and the mobile app cannot place orders. Within twenty minutes the on-call engineer finds the cause: the TLS certificate on the internal payment gateway expired at midnight. Nobody knew it existed. The engineer who installed it left two years ago, and the renewal reminders went to his old mailbox. Issuing a new certificate needs approval from someone who is asleep. Stores open at 07:00. How do you fix it tonight, and how do you find the next one?