100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
It is day five after ransomware hit a 1,400-person insurance broker. Identity has been rebuilt and the attacker appears to be out. The infrastructure team can restore about twelve systems a day. Twenty-three business owners have each told the CEO their system is the most critical: claims, policy administration, finance, the broker portal, email archives. Two large clients threaten to move their accounts if the portal is not back by Monday. Yesterday a restored file server was found to contain the attacker's remote access tool and had to be taken down again. Who decides what comes back next, and on what basis?
At 07:30 on Monday the head of IT calls the CEO. Most office systems show a ransom note, email is down, and only the phones work. Staff are arriving and asking what to do. The note gives an email address and says the price doubles in 48 hours. Your cyber insurance policy sits in a shared folder that is now encrypted. Nobody is sure who should be in the room or who decides. In one hour the first customer calls will start. What happens in that hour?
A senior account executive resigned on Friday and joins a direct competitor in two weeks. On Monday, a data loss alert shows she synced 4,000 files to a personal cloud account over the weekend, including a full CRM export, pricing models and the customer contract folder. She is on garden leave but still has a working laptop and VPN access. Her manager insists she is trustworthy and that this is 'just her portfolio'. Legal wants to act before anything reaches the competitor. What do you do, and in what order?
The head of sales operations clicked a link to a shared proposal on Monday and signed in as usual, MFA and all. This morning your identity logs show her session in use from a hosting provider while she is also active from the office, with no new sign-in and no MFA prompt. Overnight the session read 900 emails, downloaded the pricing folder, exported contacts from the CRM through single sign-on and consented to a new mail app. The help desk reset her password an hour ago. The activity has not stopped. Why not, and what do you revoke?
Forty of your engineers use AI coding assistants connected to a community-built Model Context Protocol server that adds database and ticketing tools. A researcher's blog post says version 2.3 of that server added hidden instructions in its tool descriptions that tell the assistant to read local environment files and include them in a "telemetry" call. The update arrived automatically two weeks ago. Your engineers' laptops hold cloud credentials, database passwords and customer test data. Your egress logs show the telemetry domain was contacted 9,200 times. What do you assume, and what do you change?
You are on day two of investigating suspicious traffic inside the control network of a chemical blending plant. Responders have a laptop on the OT switch capturing packets. At 14:20 the safety instrumented system trips reactor R-3 on high pressure, venting to the flare and closing the feed valves. The control room saw the pressure transmitter spike, but two field gauges read normal throughout. Operators want to reset the safety system and restart the batch, which is worth $400,000. The responders want the safety controller left untouched until they know whether anyone has reached it. Who decides?
Three days after attackers stole HR files from a 900-person engineering consultancy, they change tactics. Twelve employees, including the CEO and two HR staff, receive texts on their personal phones listing their home address and their children’s school, with a demand: tell your company to pay, or this goes online. One message includes a photo of an employee’s front door. The attackers’ leak site now lists the company with a five-day countdown. Staff are frightened and some want to stay home. The board meets tomorrow. What do you do for your people today?
At 21:30 on a Sunday, armed police surround your CEO’s house after a hoax call reporting a hostage situation. Nobody is hurt, but her teenage son was handcuffed on the lawn. Within the hour, an anonymous social media account posts your CFO’s home address and writes ‘he’s next’ in a thread about recent layoffs at your 3,000-person logistics business. Some of the executives’ personal details appear to come from a data broker. Monday’s all-staff meeting at headquarters is in twelve hours. How do you protect people tonight, and what changes tomorrow?
At 19:45 on a Friday your company’s main social media account, with 450,000 followers, posts a video of your CEO announcing a giveaway: send cryptocurrency and receive double back. The video is a deepfake. Three more posts follow in ten minutes, and replies show customers who have already sent money. The social media manager is locked out because the account’s email and phone number have been changed. Nobody else knows who holds the recovery codes. The platform’s support form promises a reply within 48 hours. What do you do now?
On Tuesday morning a post on a hacking forum claims to offer the ‘full database of a national pet-insurance company, 4 million customers’ and shares a 200-row sample. Within two hours it is on social media, a tech news site asks for comment, and your share price falls 6% at the open. Your security team checks the sample: the rows are real customers, but the fields match an old marketing list a former partner held, not your systems. Your logs show no intrusion so far. Customers are calling to cancel. How sure do you need to be before you say ‘we were not breached’?
Your acquiring bank emails: card-fraud analysis links 212 fraudulent transactions to cards used on your online store over the past five weeks, and they want a forensic investigation. Your developers find nothing changed in your own code. Then a front-end engineer notices the checkout page loads a chat widget from a vendor's CDN, and the script now contains 40 extra lines of obfuscated JavaScript that post form fields to an unfamiliar domain. The widget is on every page, including payment. Peak-season trading starts in nine days. What do you remove, what do you keep, and what do you tell the bank?
Two days before a municipal election, a 40-second audio clip spreads on social media. It sounds like your county's chief election official telling a colleague that ballots from two precincts 'will be handled differently this year'. A second post, styled like your website, says three polling places have moved. Your official never said this, and nothing has moved. By noon the clip has 300,000 plays, your phone lines are jammed, and a candidate is demanding an explanation. Your public results website is also seeing unusual traffic. How do you respond without amplifying the fake?
Your project-management SaaS has been degraded for six hours. Officially the cause is 'database performance'. In reality the security team took two clusters offline after finding an attacker's web shell on an API server, and nobody yet knows whether customer data was accessed. The public status page still shows a yellow 'degraded' banner. Enterprise customers are asking about SLA credits, two have asked outright whether this is a security incident, and one has a contractual 48-hour breach-notice clause. Sales wants the status page to say 'scheduled maintenance'. What does the status page say now?
It is 07:40. Overnight your SOC confirmed that an intruder has had access to the customer database for at least nine days. Containment is under way but not finished. The chair has heard a rumour from another director and wants a call with the full board at 18:00 today. You do not yet know how many records were taken, whether the attacker is still inside, or whether a regulatory clock has started. You have ten hours to decide what the board needs to hear, who says it, and what you will refuse to guess at.
Three weeks after a ransomware attack, your company has spent 1.8 million on forensics, overtime and lost revenue. The insurer's coverage letter arrives. It reserves its rights and cites two problems. The application you signed last year stated that multi-factor authentication was enforced for all remote access, but the attacker came in through a legacy VPN account without it. And a war and state-actor exclusion may apply, because a government advisory linked the ransomware group to a hostile state. Finance needs to know what to book this quarter.
At 14:10 on a Friday your online store is taken offline by an attack that has encrypted the order database. The CEO is on a 14-hour flight with no reliable connectivity and lands tomorrow morning. The COO is on leave. Someone has to decide whether to shut down the payment gateway, whether to tell customers, and whether to engage an incident response firm that wants 250,000 dollars up front. The incident plan says 'the CEO approves'. It says nothing else.
Four days after you notified 210,000 customers that their names, addresses and loyalty account details were exposed, a plaintiffs' law firm publishes a press release saying it is investigating claims against your retail chain and inviting affected customers to get in touch. A demand letter citing a state privacy statute arrives the next day. Customer support is fielding calls asking whether people should join. Your forensic firm is still finishing its report. What gets written down now may be read in court later.
At 16:45 the communications team takes a call from a reporter at a national business publication. She says a source has shown her files that appear to come from your HR system, including salary data for senior staff, and she plans to publish tomorrow morning. She wants a comment by 20:00. Your security team has no open incident, no alert matches, and nobody has seen the files. You have three hours and fifteen minutes to find out whether it is true and decide what you will say.
Monday: ransomware encrypts file servers at your online travel agency, but customer bookings still work. Wednesday: after you decline to engage, a DDoS takes the booking site down at peak hour. Thursday: the attacker emails journalists a sample of passport scans and threatens to call your largest corporate customers. Each pressure point lands on a different team that is already exhausted. The attacker's latest message sets a 24-hour deadline and promises the DDoS will stop the moment you pay.
At 10:20 your SOC escalates a confirmed business email compromise: an attacker in the CFO's mailbox has redirected a 1.3 million dollar supplier payment due to leave at 15:00. At 10:35 a second escalation: crypto-mining containers are running in production Kubernetes after a leaked deploy token, and the same token can push images. You have four incident responders, one of them on leave, and a retainer firm that can send two people tomorrow. Who works on what first?