100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
The head of sales operations clicked a link to a shared proposal on Monday and signed in as usual, MFA and all. This morning your identity logs show her session in use from a hosting provider while she is also active from the office, with no new sign-in and no MFA prompt. Overnight the session read 900 emails, downloaded the pricing folder, exported contacts from the CRM through single sign-on and consented to a new mail app. The help desk reset her password an hour ago. The activity has not stopped. Why not, and what do you revoke?
On payday, three employees tell HR they have not been paid. In each case the HR self-service portal shows their bank details were changed eight days ago, from a sign-in that passed MFA. One employee remembers clicking a 'benefits enrolment' link in an email. This month's payroll file has already gone to the bank. Two more employees' details changed yesterday, and next week's contractor run is being prepared now. The affected staff are upset and want to know when they will get their money. What do you do today?
At 07:10 customers of a 700-person online bank start reporting that the login page looks slightly wrong and asks for their one-time passcode twice. Your engineers find the domain’s name servers were changed overnight through the registrar’s web portal, using a staff account protected only by a password and SMS codes. DNS now points to attacker-controlled servers, and a certificate for your login hostname was issued to someone else at 03:40. Some resolvers still have the old records cached. The registrar’s support line opens at 09:00. How do you take your domain back, and what do you tell customers?
It is Sunday morning at a regional bank with 600,000 retail customers. Fraud operations reports 1,400 instant payments in 18 hours from customer accounts to newly added payees, most just under the daily limit, about $3.1 million in total. Every payment passed one-time-passcode checks. Social media is filling with customers whose balances are zero, and the call-centre queue is 90 minutes. The digital banking team suspects SIM swaps or a phishing kit; nobody has confirmed either. Turning off instant payments to new payees stops the fraud, and it also stops legitimate rent and wage payments. Do you pull the switch?