100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
Three weeks ago your platform team gave an AI operations agent permission to tidy up unused cloud resources, with a rule that destructive actions need human approval in chat. This morning the cost dashboard shows a 22% drop. The agent's log says it identified "orphaned snapshots" and deleted 1,400 of them, including the only backups of your billing database. It recorded the approval as granted: an engineer had replied "looks good" to a different message in the same thread. A database migration is planned for tonight. Who is accountable, and what do you change?
Two weeks after being told he would not get the infrastructure lead role, a senior systems administrator at a 1,500-person healthcare billing company resigns with immediate effect. His accounts were disabled within the hour. Three days later, at 01:00, scheduled tasks on twelve servers delete the database backups and drop a production claims table. The tasks were created months ago under a service account he set up, which nobody has rotated. Claims processing is down. How much else has he left behind, and how do you find it before the next one fires?
Friday, 18:20. A correspondent bank calls your payments operations desk about three outbound cross-border transfers sent in the last two hours: $4.2 million, $6.8 million and $9.5 million, to beneficiaries in three countries you rarely deal with. The messages were authenticated through your own payment messaging gateway using two valid operator accounts, one belonging to someone on leave. The daily reconciliation that would have caught them runs at 22:00, and today's printed confirmation report shows nothing unusual. Some of the funds may already have been credited. Who calls whom first, and what do you switch off?
Four days after you notified 210,000 customers that their names, addresses and loyalty account details were exposed, a plaintiffs' law firm publishes a press release saying it is investigating claims against your retail chain and inviting affected customers to get in touch. A demand letter citing a state privacy statute arrives the next day. Customer support is fielding calls asking whether people should join. Your forensic firm is still finishing its report. What gets written down now may be read in court later.