100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
A threat-intelligence feed your team subscribes to posts a new entry: a ransomware group claims to have stolen 600 GB from a small order-fulfilment company. You use that company to ship orders, and you send it customer names, addresses, phone numbers and order contents every day. The listing includes a file tree with a folder named after your brand. The vendor has not contacted you. When you call, the owner says they "had a computer problem last week" and that their IT provider is handling it. You are the data controller for those customers.
A customer of your 400-person HR software company opens a support ticket with a screenshot: their dashboard search returned salary records belonging to another customer's employees. Engineering traces it to a caching change deployed nine days ago that sometimes keys results by query text instead of by tenant. Logs show the faulty path ran at least 6,000 times, but nobody yet knows how many of those responses held another tenant's data, or which tenants saw what. You process data for 1,100 business customers, most of them in the EU and UK. The fix is ready. Do you ship it now?