100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
It is Wednesday morning. Payroll for 2,300 staff must reach the bank by 14:00 Thursday to land on Friday. Overnight, ransomware encrypted the HR and payroll servers and the file share holding timesheets. IT estimates at least four days to restore. Last month's bank file still sits in a finance team member's email. Union representatives have heard rumours and are asking whether people will be paid this week. The CFO asks the room: can we just re-run last month's payroll? What do you decide, and how do you tell 2,300 people?
An HR coordinator meant to email a salary review spreadsheet to the payroll provider. Autocomplete picked a similar name at a recruitment agency instead. The file holds names, salaries, home addresses and sickness absence notes for 340 employees. An hour later the recipient replied: 'I think this was meant for someone else.' The coordinator is panicking and has asked a friend in IT to 'just recall it'. It is now 16:30 on a Thursday. What happens next, and who needs to know?
Your incident response firm believes the attacker who compromised your identity provider can still get back in, but cannot yet prove how. Their recommendation: take single sign-on offline for all 3,000 staff for up to 24 hours from 18:00 tonight while they rebuild trust. That means no email, no CRM, no payroll system, no ticketing and no remote access. Sales has a quarter-end close in two days. Customers know nothing yet. The CEO wants a decision from the room by 17:00. What do you decide, and what are you accepting by deciding it?
On payday, three employees tell HR they have not been paid. In each case the HR self-service portal shows their bank details were changed eight days ago, from a sign-in that passed MFA. One employee remembers clicking a 'benefits enrolment' link in an email. This month's payroll file has already gone to the bank. Two more employees' details changed yesterday, and next week's contractor run is being prepared now. The affected staff are upset and want to know when they will get their money. What do you do today?
It is Wednesday morning and 2,600 staff are due to be paid on Friday. Your outsourced payroll provider has been offline since last night. Its status page says "investigating a security incident affecting some systems" and gives no recovery time. Your payroll team cannot submit the final run, and the provider has the only copy of this month's calculated pay, tax and deductions. Social media already has posts from employees at other companies using the same provider. Your union representative has asked HR whether pay will arrive on time. The CEO wants a decision by noon.
Day two of a ransomware outage at a 2,000-person logistics company. Dispatch, billing and the warehouse system are encrypted. The attacker wants 4.2 million dollars in cryptocurrency, offers a 20% discount if you pay within 48 hours, and has published a sample of stolen payroll files. IT says restoring from backup will take nine to fourteen days, and two of the backup sets have not been verified clean. The insurer's panel negotiator is on the line. The CEO turns to the room and asks for a recommendation by 17:00.