100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
It is 23:15 on the Friday before a long weekend. The only on-call engineer gets an alert for mass file renames on a file server, then twelve more servers in five minutes. The SOC is outsourced: it has opened a ticket but cannot isolate hosts without written approval. The IT manager is on a flight until 06:00, the CISO is not answering, and the incident response retainer's hotline wants a contract number nobody on shift has. The attacker is still active. Who can authorise isolation right now, and what do you pull first?
Your platform team moved CI to keyless federated identity last quarter: pipelines exchange a signed token for a short-lived cloud deploy role. Tonight the SOC sees that role assumed 31 times in two hours. The token claims name a repository under an organisation you have never heard of. The trust policy, it turns out, checks the identity provider but not which organisation the token comes from. Using the role, someone has created two new identities, read your secrets store and changed a load balancer rule in production. Nothing has failed yet. Where do you cut, and what do you trust after?
Your team has spent six hours on an active intrusion in production: an attacker with a stolen engineer session is moving between services, and you are close to cutting them off. At 16:05 your cloud provider posts a major incident for your primary region. Half your services are unreachable, including the logging pipeline and the identity console you were using to contain the attacker. Customers are calling. Your disaster-recovery runbook says to fail over to the secondary region, which is built from the same templates and secrets the attacker may have already read. Do you fail over?
At 21:30 on a Sunday, armed police surround your CEO’s house after a hoax call reporting a hostage situation. Nobody is hurt, but her teenage son was handcuffed on the lawn. Within the hour, an anonymous social media account posts your CFO’s home address and writes ‘he’s next’ in a thread about recent layoffs at your 3,000-person logistics business. Some of the executives’ personal details appear to come from a data broker. Monday’s all-staff meeting at headquarters is in twelve hours. How do you protect people tonight, and what changes tomorrow?
At 19:45 on a Friday your company’s main social media account, with 450,000 followers, posts a video of your CEO announcing a giveaway: send cryptocurrency and receive double back. The video is a deepfake. Three more posts follow in ten minutes, and replies show customers who have already sent money. The social media manager is locked out because the account’s email and phone number have been changed. Nobody else knows who holds the recovery codes. The platform’s support form promises a reply within 48 hours. What do you do now?
It is 02:40 on a Saturday at a 450-bed regional hospital. The night supervisor calls: the electronic health record is frozen, workstations on three wards show a ransom note, and the pharmacy dispensing system has dropped offline. The emergency department has 31 patients, two ambulances are ten minutes out, and the trauma surgeon on call wants to know whether to divert. Downtime procedures exist on paper, but nobody has run them for longer than four hours. The ransom note says patient data has already been copied. Who decides on diversion, and what do you tell the ambulance service right now?
It is Sunday morning at a regional bank with 600,000 retail customers. Fraud operations reports 1,400 instant payments in 18 hours from customer accounts to newly added payees, most just under the daily limit, about $3.1 million in total. Every payment passed one-time-passcode checks. Social media is filling with customers whose balances are zero, and the call-centre queue is 90 minutes. The digital banking team suspects SIM swaps or a phishing kit; nobody has confirmed either. Turning off instant payments to new payees stops the fraud, and it also stops legitimate rent and wage payments. Do you pull the switch?
Friday, 18:20. A correspondent bank calls your payments operations desk about three outbound cross-border transfers sent in the last two hours: $4.2 million, $6.8 million and $9.5 million, to beneficiaries in three countries you rarely deal with. The messages were authenticated through your own payment messaging gateway using two valid operator accounts, one belonging to someone on leave. The daily reconciliation that would have caught them runs at 22:00, and today's printed confirmation report shows nothing unusual. Some of the funds may already have been credited. Who calls whom first, and what do you switch off?
Your project-management SaaS has been degraded for six hours. Officially the cause is 'database performance'. In reality the security team took two clusters offline after finding an attacker's web shell on an API server, and nobody yet knows whether customer data was accessed. The public status page still shows a yellow 'degraded' banner. Enterprise customers are asking about SLA credits, two have asked outright whether this is a security incident, and one has a contractual 48-hour breach-notice clause. Sales wants the status page to say 'scheduled maintenance'. What does the status page say now?
Day two of a ransomware outage at a 2,000-person logistics company. Dispatch, billing and the warehouse system are encrypted. The attacker wants 4.2 million dollars in cryptocurrency, offers a 20% discount if you pay within 48 hours, and has published a sample of stolen payroll files. IT says restoring from backup will take nine to fourteen days, and two of the backup sets have not been verified clean. The insurer's panel negotiator is on the line. The CEO turns to the room and asks for a recommendation by 17:00.
Ninety days after closing the purchase of a 500-person engineering firm, your team starts connecting its network to yours. EDR, newly installed on their servers, flags a scheduled task that calls out to an external host every six hours. It has existed since before the deal was announced. The two Active Directory forests already share a trust, and 40 of the firm's admins have accounts in your environment. Integration milestones are tied to executive bonuses. Do you cut the trust today?
A threat-intelligence feed alerts you that your regional law firm has been listed on a ransomware group's leak site. The post shows a timer with 72 hours remaining, a list of client names, and three screenshots of documents that look like your matter files. There has been no ransomware outbreak and no ransom note, and IT finds nothing encrypted. Partners are asking whether this is real, whether clients must be told before the timer runs out, and whether anyone should contact the group.