100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
Your team has spent six hours on an active intrusion in production: an attacker with a stolen engineer session is moving between services, and you are close to cutting them off. At 16:05 your cloud provider posts a major incident for your primary region. Half your services are unreachable, including the logging pipeline and the identity console you were using to contain the attacker. Customers are calling. Your disaster-recovery runbook says to fail over to the secondary region, which is built from the same templates and secrets the attacker may have already read. Do you fail over?
It is Wednesday morning and 2,600 staff are due to be paid on Friday. Your outsourced payroll provider has been offline since last night. Its status page says "investigating a security incident affecting some systems" and gives no recovery time. Your payroll team cannot submit the final run, and the provider has the only copy of this month's calculated pay, tax and deductions. Social media already has posts from employees at other companies using the same provider. Your union representative has asked HR whether pay will arrive on time. The CEO wants a decision by noon.
It is 09:00 on Black Friday at an online homeware retailer that takes 18% of its annual revenue in the next four days. Requests to the checkout API jump to 40 times normal, response times pass ten seconds and the site starts returning errors. An email arrives at the press address: pay 5 bitcoin or the site stays down all weekend. Your CDN has basic DDoS protection, but the checkout API sits outside it on a separate hostname. Marketing has a promotional email going to 3 million customers at 10:00. What do you do in the next hour?
At 07:10 customers of a 700-person online bank start reporting that the login page looks slightly wrong and asks for their one-time passcode twice. Your engineers find the domain’s name servers were changed overnight through the registrar’s web portal, using a staff account protected only by a password and SMS codes. DNS now points to attacker-controlled servers, and a certificate for your login hostname was issued to someone else at 03:40. Some resolvers still have the old records cached. The registrar’s support line opens at 09:00. How do you take your domain back, and what do you tell customers?
At 00:01 on the first of the month, card payments at a 300-store pharmacy chain start failing. Tills show ‘connection error’ and the mobile app cannot place orders. Within twenty minutes the on-call engineer finds the cause: the TLS certificate on the internal payment gateway expired at midnight. Nobody knew it existed. The engineer who installed it left two years ago, and the renewal reminders went to his old mailbox. Issuing a new certificate needs approval from someone who is asleep. Stores open at 07:00. How do you fix it tonight, and how do you find the next one?
A severe storm has hit the region served by a 1,200-person home insurer, and claims calls are at five times normal volume. At 08:20 the cloud contact-centre platform your agents use for calls, chat and call recording goes down across the provider’s entire region. The provider’s status page says ‘investigating’ and gives no estimate. Agents can still log into the claims system but cannot take calls. Customers with flooded homes are getting a dead line, and local radio has started asking why. Your contract’s service credit is worth one month’s fees. What is your plan for the next eight hours?
At 07:15 on a Tuesday, your EU payment institution loses its core transaction database after a fault at the cloud provider that hosts it. Card authorisations are failing for about 40% of merchants across four member states. The provider's status page says 'degraded performance' and gives no estimate. By 09:00 your service desk has logged 2,300 merchant complaints. Your head of compliance asks the question nobody has answered yet: is this a major ICT-related incident under DORA, and if so, when did the clock start? The CEO wants to know what goes to the regulator, and when.
At 09:31 on the morning of a major interest-rate announcement, your online brokerage's order-entry service starts returning errors. Customers can log in and see positions but cannot place or cancel orders. Traffic is four times a normal day. A configuration change to the order-routing gateway went out at 08:50, and the network team is also seeing a surge from a few thousand IP addresses that could be a DDoS or could be your own customers' apps retrying. Customers with open positions are posting angrily on social media. Roll back, scale out or block traffic? You have one move to make first.
It is 20:05 on Black Friday. Your online retailer's checkout has been failing for 18 minutes; about one payment attempt in three times out. The promotional email to 2.4 million customers went out at 20:00. Revenue for this hour last year was $1.9 million. Engineering thinks the payment provider is rate-limiting you; the payment provider says its systems are healthy. Social media has noticed, and a competitor has just extended its own sale by an hour. The CEO has joined the bridge and wants to know whether to pause the promotion. What do you decide in the next ten minutes?
Day two of a ransomware outage at a 2,000-person logistics company. Dispatch, billing and the warehouse system are encrypted. The attacker wants 4.2 million dollars in cryptocurrency, offers a 20% discount if you pay within 48 hours, and has published a sample of stolen payroll files. IT says restoring from backup will take nine to fourteen days, and two of the backup sets have not been verified clean. The insurer's panel negotiator is on the line. The CEO turns to the room and asks for a recommendation by 17:00.