100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
It is 05:40 on a Tuesday. Hundreds of servers are rebooting into a ransom note. The infrastructure team goes to restore and finds the backup console showing the same note: the backup server was joined to the domain, and the attacker deleted the restore catalogue and encrypted the on-site repository. An offsite copy exists in cloud object storage, but nobody has restored from it in fourteen months and nobody is sure whether its retention lock can be overridden. The business wants a restore time by 09:00. What do you tell them, and what do you touch first?
It is day five after ransomware hit a 1,400-person insurance broker. Identity has been rebuilt and the attacker appears to be out. The infrastructure team can restore about twelve systems a day. Twenty-three business owners have each told the CEO their system is the most critical: claims, policy administration, finance, the broker portal, email archives. Two large clients threaten to move their accounts if the portal is not back by Monday. Yesterday a restored file server was found to contain the attacker's remote access tool and had to be taken down again. Who decides what comes back next, and on what basis?
The finance team forwards a billing alert at 08:15: your cloud spend for the last 24 hours is $182,400 against a usual $3,000. The cloud team finds hundreds of large GPU instances running in four regions you have never used. They were launched from the root account of a development tenancy that nobody has logged into for a year. Its recovery email points to a former employee's personal address. Your provider's support line says a credit "may be considered" once you secure the account. The instances are still running and costing roughly $7,500 an hour.
Your team has spent six hours on an active intrusion in production: an attacker with a stolen engineer session is moving between services, and you are close to cutting them off. At 16:05 your cloud provider posts a major incident for your primary region. Half your services are unreachable, including the logging pipeline and the identity console you were using to contain the attacker. Customers are calling. Your disaster-recovery runbook says to fail over to the secondary region, which is built from the same templates and secrets the attacker may have already read. Do you fail over?
It is Wednesday morning and 2,600 staff are due to be paid on Friday. Your outsourced payroll provider has been offline since last night. Its status page says "investigating a security incident affecting some systems" and gives no recovery time. Your payroll team cannot submit the final run, and the provider has the only copy of this month's calculated pay, tax and deductions. Social media already has posts from employees at other companies using the same provider. Your union representative has asked HR whether pay will arrive on time. The CEO wants a decision by noon.
At 19:45 on a Friday your company’s main social media account, with 450,000 followers, posts a video of your CEO announcing a giveaway: send cryptocurrency and receive double back. The video is a deepfake. Three more posts follow in ten minutes, and replies show customers who have already sent money. The social media manager is locked out because the account’s email and phone number have been changed. Nobody else knows who holds the recovery codes. The platform’s support form promises a reply within 48 hours. What do you do now?
Six days into recovering from ransomware at a regional hospital, about 70% of servers have been rebuilt and clinical systems are coming back online. Then EDR on a freshly restored file server flags the same loader seen at the start of the incident, calling out to a new domain. Two domain controllers were restored from backup rather than rebuilt from scratch. Clinicians have been told everything will be back by Monday. Do you halt the recovery, and how do you find what you missed?