100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
It is 05:40 on a Tuesday. Hundreds of servers are rebooting into a ransom note. The infrastructure team goes to restore and finds the backup console showing the same note: the backup server was joined to the domain, and the attacker deleted the restore catalogue and encrypted the on-site repository. An offsite copy exists in cloud object storage, but nobody has restored from it in fourteen months and nobody is sure whether its retention lock can be overridden. The business wants a restore time by 09:00. What do you tell them, and what do you touch first?
Four days after you contained a ransomware attack and restored most systems from backup, a threat intelligence vendor emails your CISO a screenshot. Your company is listed on the group's leak site with a 72-hour countdown and a sample: forty scanned employee passports and a folder of customer contracts. The listing claims 600 GB was taken and will be published unless you pay $2.4 million. Your original investigation found no sign of data theft, and staff were told so. A trade reporter has already left a voicemail asking for comment. Do you engage, and what do you say?
It is Wednesday morning. Payroll for 2,300 staff must reach the bank by 14:00 Thursday to land on Friday. Overnight, ransomware encrypted the HR and payroll servers and the file share holding timesheets. IT estimates at least four days to restore. Last month's bank file still sits in a finance team member's email. Union representatives have heard rumours and are asking whether people will be paid this week. The CFO asks the room: can we just re-run last month's payroll? What do you decide, and how do you tell 2,300 people?
It is 23:15 on the Friday before a long weekend. The only on-call engineer gets an alert for mass file renames on a file server, then twelve more servers in five minutes. The SOC is outsourced: it has opened a ticket but cannot isolate hosts without written approval. The IT manager is on a flight until 06:00, the CISO is not answering, and the incident response retainer's hotline wants a contract number nobody on shift has. The attacker is still active. Who can authorise isolation right now, and what do you pull first?
It is day five after ransomware hit a 1,400-person insurance broker. Identity has been rebuilt and the attacker appears to be out. The infrastructure team can restore about twelve systems a day. Twenty-three business owners have each told the CEO their system is the most critical: claims, policy administration, finance, the broker portal, email archives. Two large clients threaten to move their accounts if the portal is not back by Monday. Yesterday a restored file server was found to contain the attacker's remote access tool and had to be taken down again. Who decides what comes back next, and on what basis?
At 07:30 on Monday the head of IT calls the CEO. Most office systems show a ransom note, email is down, and only the phones work. Staff are arriving and asking what to do. The note gives an email address and says the price doubles in 48 hours. Your cyber insurance policy sits in a shared folder that is now encrypted. Nobody is sure who should be in the room or who decides. In one hour the first customer calls will start. What happens in that hour?
At 02:10 on a Sunday your on-call engineer sees the managed service provider's remote-management agent running a PowerShell script on every Windows server at once. The script disables backup agents and the EDR service. Your MSP's emergency line rings out. Their status page is fine. You have the console credentials for your own tenant but not for the MSP's master console, and their agent runs as SYSTEM on 340 servers and 1,200 laptops. Within ten minutes, file servers in two offices begin renaming files. What do you pull first?
A threat-intelligence feed your team subscribes to posts a new entry: a ransomware group claims to have stolen 600 GB from a small order-fulfilment company. You use that company to ship orders, and you send it customer names, addresses, phone numbers and order contents every day. The listing includes a file tree with a folder named after your brand. The vendor has not contacted you. When you call, the owner says they "had a computer problem last week" and that their IT provider is handling it. You are the data controller for those customers.
It is 05:40 on a Monday at a 900-person auto-parts manufacturer running three shifts. Office laptops started showing ransom notes an hour ago. Now the night-shift supervisor reports that two HMI screens on the stamping line show the same note, and the historian server has stopped updating. The PLCs are still running and the presses are still making parts, but operators can no longer see process values on screen. The first shift arrives in 80 minutes. Do you keep the line running blind, shut it down, or cut the plant off from the corporate network first?
Three days after attackers stole HR files from a 900-person engineering consultancy, they change tactics. Twelve employees, including the CEO and two HR staff, receive texts on their personal phones listing their home address and their children’s school, with a demand: tell your company to pay, or this goes online. One message includes a photo of an employee’s front door. The attackers’ leak site now lists the company with a five-day countdown. Staff are frightened and some want to stay home. The board meets tomorrow. What do you do for your people today?
It is 02:40 on a Saturday at a 450-bed regional hospital. The night supervisor calls: the electronic health record is frozen, workstations on three wards show a ransom note, and the pharmacy dispensing system has dropped offline. The emergency department has 31 patients, two ambulances are ten minutes out, and the trauma surgeon on call wants to know whether to divert. Downtime procedures exist on paper, but nobody has run them for longer than four hours. The ransom note says patient data has already been copied. Who decides on diversion, and what do you tell the ambulance service right now?
A journalist emails your communications team at 16:10 on a Thursday. She has a screenshot of a leak-site post naming your 22-clinic outpatient group, with a sample file of 300 patient records: names, dates of birth, diagnoses and insurance numbers. The post claims 1.2 million records and gives you five days before full publication. Your security team has seen no ransomware and no obvious intrusion. The journalist wants comment by 18:00 and says two patients have already contacted her. You do not yet know whether the data is real, current or even yours. What happens before 18:00?
Monday, 07:30. Staff at a county council serving 280,000 residents arrive to find file shares encrypted and the housing benefits, social care case management and parking systems unavailable. Phones still work, but the contact centre cannot see case records. A social worker needs a child's safeguarding history for an emergency court hearing at 11:00. The ransom note demands payment within 72 hours and threatens to publish residents' data. Councillors are already asking questions, and a local reporter has heard that the payments portal is down. What do you prioritise this morning?
At 05:00 on a Wednesday, your logistics company's warehouse management and transport management systems go dark across six distribution centres. Ransom notes are on the servers. Forty trucks are queued at the gates, the handheld scanners cannot print labels, and a pharmaceutical customer has temperature-controlled stock that must ship by 14:00. Customs declarations for two ports are filed from the same encrypted system. Your largest retail customer's contract has a penalty clause for missed delivery windows. The operations director wants to restart on paper. Can you, and what has to be true first?
Your food-packaging plant runs three shifts and produces about $95,000 of product an hour. At 10:00 the SOC confirms ransomware on the corporate network and finds the same malware on one engineering workstation that can reach the lines' controllers. The lines are running normally. Isolating the plant network means losing the production schedule and batch records held in IT systems and running on paper at reduced output. A full shutdown is safest and costs more every hour. A major customer's promotion depends on next week's shipments. The board chair wants options and numbers by 13:00.
Day two of a ransomware outage at a 2,000-person logistics company. Dispatch, billing and the warehouse system are encrypted. The attacker wants 4.2 million dollars in cryptocurrency, offers a 20% discount if you pay within 48 hours, and has published a sample of stolen payroll files. IT says restoring from backup will take nine to fourteen days, and two of the backup sets have not been verified clean. The insurer's panel negotiator is on the line. The CEO turns to the room and asks for a recommendation by 17:00.
Three weeks after a ransomware attack, your company has spent 1.8 million on forensics, overtime and lost revenue. The insurer's coverage letter arrives. It reserves its rights and cites two problems. The application you signed last year stated that multi-factor authentication was enforced for all remote access, but the attacker came in through a legacy VPN account without it. And a war and state-actor exclusion may apply, because a government advisory linked the ransomware group to a hostile state. Finance needs to know what to book this quarter.
You signed the agreement to buy a regional medical-billing company three weeks ago. Closing is in five weeks, pending regulatory approval. This morning the target's CEO calls: ransomware hit them overnight and patient billing records may have been taken. Your security team wants to send people in to help. Your lawyers warn that you cannot run the target's business before close. The agreement has a material adverse effect clause, and your board meets in four days. What do you do, and what are you allowed to do?
A threat-intelligence feed alerts you that your regional law firm has been listed on a ransomware group's leak site. The post shows a timer with 72 hours remaining, a list of client names, and three screenshots of documents that look like your matter files. There has been no ransomware outbreak and no ransom note, and IT finds nothing encrypted. Partners are asking whether this is real, whether clients must be told before the timer runs out, and whether anyone should contact the group.
Monday: ransomware encrypts file servers at your online travel agency, but customer bookings still work. Wednesday: after you decline to engage, a DDoS takes the booking site down at peak hour. Thursday: the attacker emails journalists a sample of passport scans and threatens to call your largest corporate customers. Each pressure point lands on a different team that is already exhausted. The attacker's latest message sets a 24-hour deadline and promises the DDoS will stop the moment you pay.
Six days into recovering from ransomware at a regional hospital, about 70% of servers have been rebuilt and clinical systems are coming back online. Then EDR on a freshly restored file server flags the same loader seen at the start of the incident, calling out to a new domain. Two domain controllers were restored from backup rather than rebuilt from scratch. Clinicians have been told everything will be back by Monday. Do you halt the recovery, and how do you find what you missed?