100 ready-to-run cyber tabletop exercises across 15 incident domains. Search them, pick one at random, or tell us who will be in the room and we'll rank the scenarios that fit those people best. Every exercise shows who to involve, how long it runs and an outline — and the scenario prompt is free to copy and read out.
Running one for real? Pro adds the facilitator's run sheet for each exercise: a minute-by-minute timeline, timed injects, step-by-step facilitation guide and the questions to put to each person. Or build your own with the Tabletop Runbook Generator.
Who's in the room?
Pick the people you have — we'll suggest exercises that fit them.
Four days after you contained a ransomware attack and restored most systems from backup, a threat intelligence vendor emails your CISO a screenshot. Your company is listed on the group's leak site with a 72-hour countdown and a sample: forty scanned employee passports and a folder of customer contracts. The listing claims 600 GB was taken and will be published unless you pay $2.4 million. Your original investigation found no sign of data theft, and staff were told so. A trade reporter has already left a voicemail asking for comment. Do you engage, and what do you say?
The head of sales operations clicked a link to a shared proposal on Monday and signed in as usual, MFA and all. This morning your identity logs show her session in use from a hosting provider while she is also active from the office, with no new sign-in and no MFA prompt. Overnight the session read 900 emails, downloaded the pricing folder, exported contacts from the CRM through single sign-on and consented to a new mail app. The help desk reset her password an hour ago. The activity has not stopped. Why not, and what do you revoke?
Police call your office manager at 06:30: a ground-floor window at your accounting firm’s branch office was smashed overnight. When staff arrive they find eleven laptops missing from desks, plus the small network storage box from the comms cupboard that the branch used for scanned client documents. IT believes the laptops are encrypted but is not sure about two older ones. Nobody knows exactly what was on the storage box or whether it was backed up. Tax season starts in three weeks. Is this a theft or a data breach?
A senior engineer at a 250-person fintech hands in her notice on Friday, saying she is joining a competitor. On Monday a routine review of source-control audit logs shows her account cloned 140 repositories in the ten days before she resigned, including the fraud-scoring models she never worked on. Her work laptop also synced to a personal cloud drive twice last week. She is still working her notice period, has production access, and is well liked. HR wants to handle it quietly. Legal wants evidence first. What happens today?
You are a listed software company. On Monday the security team confirmed that an attacker took source code and a database of 1.1 million customer contact records through a compromised build server. Revenue impact is unclear, and two large customers have asked whether their API keys were exposed. The disclosure committee meets Wednesday morning. Once you determine the incident is material, you have four business days to file. Some in the room want to wait for the forensic report due in three weeks. Others think the decision is already overdue.
Your accounting software company refused a ransom demand last week after a data theft. This morning hundreds of your small-business customers received an email from the attacker. It quotes each customer's own invoice data as proof, says you 'chose not to protect them', and invites them to pay 500 dollars each to have their records deleted. Support has 900 tickets in the queue. Two customers have posted the email on social media, and one says they have already paid.
A threat-intelligence feed alerts you that your regional law firm has been listed on a ransomware group's leak site. The post shows a timer with 72 hours remaining, a list of client names, and three screenshots of documents that look like your matter files. There has been no ransomware outbreak and no ransom note, and IT finds nothing encrypted. Partners are asking whether this is real, whether clients must be told before the timer runs out, and whether anyone should contact the group.