100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
Executive
Business
Technical
Matching exercises
7 of 100
DevSecOps / supply chainIntermediateTechnical 1 h 45 min
A public advisory says a popular open-source logging package was hijacked: version 4.8.2, published three days ago, runs a post-install script that reads environment variables and sends them to a remote server. Your dependency manifests allow minor updates. A quick search shows 14 of your repositories pulled 4.8.2, and your CI runners, which hold cloud deploy credentials, package registry tokens and a signing key in their environment, built every one of them, many times. Two developers also installed it on their laptops. What do you assume was taken?
A release engineer runs a reproducible-build check on tomorrow's release and it fails: the compiled agent your customers install on 40,000 endpoints contains a 3 KB block that is not in any commit. Rebuilding on a clean machine gives a different hash. The build server's scheduled tasks include a script nobody recognises, created five weeks ago. Your last two releases came off the same server and are already in customers' hands. Release is scheduled for 09:00 tomorrow and the sales team has promised the new version to your largest customer.
A customer's security team calls your CISO at 07:30. Their EDR flagged your desktop agent, version 9.4.1, released nine days ago and signed with your code-signing certificate, making outbound connections to a domain registered last month. Your engineers confirm the binary contains code that is not in your repository. Telemetry says 3,100 customer organisations have installed 9.4.1, including hospitals and two government agencies. The customer says they will post their findings publicly at noon. Your auto-update service is still offering 9.4.1 right now.
Forty of your engineers use AI coding assistants connected to a community-built Model Context Protocol server that adds database and ticketing tools. A researcher's blog post says version 2.3 of that server added hidden instructions in its tool descriptions that tell the assistant to read local environment files and include them in a "telemetry" call. The update arrived automatically two weeks ago. Your engineers' laptops hold cloud credentials, database passwords and customer test data. Your egress logs show the telemetry domain was contacted 9,200 times. What do you assume, and what do you change?
Your acquiring bank emails: card-fraud analysis links 212 fraudulent transactions to cards used on your online store over the past five weeks, and they want a forensic investigation. Your developers find nothing changed in your own code. Then a front-end engineer notices the checkout page loads a chat widget from a vendor's CDN, and the script now contains 40 extra lines of obfuscated JavaScript that post form fields to an unfamiliar domain. The widget is on every page, including payment. Peak-season trading starts in nine days. What do you remove, what do you keep, and what do you tell the bank?
At 05:00 on a Wednesday, your logistics company's warehouse management and transport management systems go dark across six distribution centres. Ransom notes are on the servers. Forty trucks are queued at the gates, the handheld scanners cannot print labels, and a pharmaceutical customer has temperature-controlled stock that must ship by 14:00. Customs declarations for two ports are filed from the same encrypted system. Your largest retail customer's contract has a penalty clause for missed delivery windows. The operations director wants to restart on paper. Can you, and what has to be true first?
At 10:20 your SOC escalates a confirmed business email compromise: an attacker in the CFO's mailbox has redirected a 1.3 million dollar supplier payment due to leave at 15:00. At 10:35 a second escalation: crypto-mining containers are running in production Kubernetes after a leaked deploy token, and the same token can push images. You have four incident responders, one of them on leave, and a retainer firm that can send two people tomorrow. Who works on what first?