Skip to content
CyberTabletop

Incident-response tabletop exercises

Rehearse the worst day before it happens.

A practical library for running cyber tabletop exercises: the method to plan and facilitate them, and ready-to-run scenarios with timed injects, discussion questions and scoring rubrics.

Browse scenariosLearn the method
scenarios
14
method guides
6
glossary terms
12
Exercise in progressExercise clockT+00:45

TTX-01 · Double-extortion ransomware

  1. T+00:00Inject · SOC

    EDR alert: mass file renames on a file server.

  2. T+00:20Inject · Service desk

    Users report shared drives will not open.

  3. T+00:45Inject · IT operations

    Hypervisor cluster unreachable; ransom note found.

Decision point

Isolate the virtualization network now, knowing it takes production offline?

Players
  • IR lead
  • CIO
  • Legal
  • Comms

The method

How to run a tabletop, step by step

Six phases take you from a blank page to a signed-off improvement plan. Each one has a detailed guide with templates.

  1. 01 / 06

    Plan & scope

    Objectives, scenario choice, participants and a 6–8 week run-up.

  2. 02 / 06

    Roles in the room

    Facilitator, controller, scribe, evaluators and players: who does what.

  3. 03 / 06

    Facilitate

    Ground rules, pacing, probing questions and a clean hotwash.

  4. 04 / 06

    Injects & MSEL

    Write injects that force decisions and sequence them on a timeline.

  5. 05 / 06

    Evaluate & score

    Capability-based rubrics and decision metrics, never grading people.

  6. 06 / 06

    After-action report

    Turn observations into owned, dated fixes and re-test them.

Scenario library

Pick a scenario, print it, run it

Every scenario card gives you the threat, difficulty, duration and audience at a glance. Open one for objectives, the inject timeline and discussion questions.

View all scenarios
TTX-01Intermediate

Double-extortion ransomware

Hypervisors encrypted on a Friday night, data on a leak site, and a ransom demand on the table.

Duration
3 h
Injects
9
Audience
Technical · Executive · Legal & privacy
T1486T1490T1567Open scenario
TTX-02Foundational

Business email compromise

A supplier's “new bank details” and a wire that already left. Can finance and IT claw it back?

Duration
2 h
Injects
8
Audience
Finance · Technical · Executive
T1566T1114T1564.008Open scenario
TTX-03Intermediate

Cloud access key leak

A long-lived key pushed to a public repo, a billing spike and storage buckets being listed.

Duration
2.5 h
Injects
8
Audience
Cloud & DevOps · Technical
T1552.001T1496T1530Open scenario
TTX-04Intermediate

Departing insider

A privileged engineer resigns and gigabytes flow to personal cloud storage. HR, legal and security must act together.

Duration
2 h
Injects
8
Audience
HR · Legal & privacy · Technical
T1567.002T1213T1078Open scenario
TTX-05Advanced

Software supply-chain compromise

A trusted vendor's signed update was trojanized, and it is installed on hundreds of your machines.

Duration
3 h
Injects
9
Audience
Technical · Executive · Communications
T1195.002T1071T1078Open scenario
TTX-06Foundational

DDoS during peak season

Your storefront and API buckle under a multi-vector flood, then an extortion email arrives.

Duration
2 h
Injects
8
Audience
IT operations · Communications · Executive
T1498T1499Open scenario

Principles

Built for exercises that change something

  • Decisions, not trivia

    Every inject is written to force a decision someone will actually face: isolate or monitor, pay or restore, notify now or investigate further.

  • Capabilities, not people

    Scoring rubrics evaluate plans, processes and communications. Nobody is graded, so people speak freely about gaps.

  • Findings with owners

    Each exercise ends with an after-action report and an improvement plan that has owners and dates, then a re-test.

New to tabletop exercises?

Start with the planning guide, then run the business email compromise scenario. It is short, needs no deep technical staff and exposes real process gaps.

Start with the planning guide