Cyber Exercise Resources
Expert guides, real-world scenarios, and best practices for running effective cyber tabletop exercises and incident response drills
Featured Articles
Colonial Pipeline Tabletop Exercise: The Shutdown Decision Your Board Should Rehearse
Ransomware hit Colonial Pipeline’s IT systems, not its pipeline controls. Leadership shut the pipeline down anyway. Here are the three decisions behind it, turned into a boardroom tabletop exercise you can run.
Introducing Facilitator Mode: Run Instructor-Led Cyber Tabletop Exercises
Run synchronized, instructor-led tabletop exercises with a shared presentation view and a private control panel. No installs, just links.
Incident Response Tabletop Exercise: Complete Guide for 2026
How to run incident response tabletop exercises that sharpen real response capability—not just satisfy auditors. Prep, scenario design, facilitation, and debrief in one place.
How to Run Your First Cyber Tabletop Exercise: Complete Guide
A practical path from zero to a first cyber tabletop this month: scenario, attendees, room setup, facilitation prompts, debrief, and a repeat cadence—without boiling the ocean.
10 Cyber Crisis Scenarios Every CISO Should Practice in 2026
Ten crisis scenarios worth rotating into your exercise program in 2026—from ransomware with exfiltration to deepfakes and combined physical-cyber events—and what each one stress-tests.
Ransomware Tabletop Exercise Scenario: Complete Walkthrough for IR Teams
A full ransomware tabletop walkthrough: injects, decision points, and facilitation notes—built to surface payment authority, backup trust, HIPAA-style timelines, media pressure, and recovery tradeoffs.
10 Best Cyber Crisis Tabletop Exercise Platforms (2026 Review)
How to choose tooling for cyber exercises in 2026: ranges vs BAS vs crisis simulation, ten representative vendors by category, and how to match platform type to SOC skills, leadership drills, or control validation.
All Articles
Colonial Pipeline Tabletop Exercise: The Shutdown Decision Your Board Should Rehearse
Ransomware hit Colonial Pipeline’s IT systems, not its pipeline controls. Leadership shut the pipeline down anyway. Here are the three decisions behind it, turned into a boardroom tabletop exercise you can run.
Read Article
MOVEit Breach Tabletop Exercise: When Your Supplier Loses Your Data
In 2023, one flaw in a file-transfer tool exposed data from thousands of organisations, many through suppliers they never thought about. A third-party breach tabletop exercise built on the MOVEit case.
Read Article
SolarWinds Tabletop Exercise: A Supply-Chain Attack Scenario for Leadership Teams
Your trusted monitoring vendor shipped you a backdoor. Nothing is down and nothing looks wrong. The three leadership decisions from the SolarWinds attack, as a tabletop exercise you can play free.
Read Article
Cyber Tabletop Exercises in the Classroom: A Guide for Instructors
How to run a cyber crisis tabletop exercise in a 90-minute class: picking the scenario, assigning roles, keeping every student involved, and grading the debrief.
Read ArticleIntroducing Facilitator Mode: Run Instructor-Led Cyber Tabletop Exercises
Run synchronized, instructor-led tabletop exercises with a shared presentation view and a private control panel. No installs, just links.
Read ArticleIncident Response Tabletop Exercise: Complete Guide for 2026
How to run incident response tabletop exercises that sharpen real response capability—not just satisfy auditors. Prep, scenario design, facilitation, and debrief in one place.
Read ArticleHow to Run Your First Cyber Tabletop Exercise: Complete Guide
A practical path from zero to a first cyber tabletop this month: scenario, attendees, room setup, facilitation prompts, debrief, and a repeat cadence—without boiling the ocean.
Read Article10 Cyber Crisis Scenarios Every CISO Should Practice in 2026
Ten crisis scenarios worth rotating into your exercise program in 2026—from ransomware with exfiltration to deepfakes and combined physical-cyber events—and what each one stress-tests.
Read Article
Executive Cyber Drill vs. Technical Incident Response: Key Differences
Technical IR exercises and executive crisis drills test different skills. Combining them into one session usually wastes one of the audiences—here is how to split them and when a joint run makes sense.
Read ArticleRansomware Tabletop Exercise Scenario: Complete Walkthrough for IR Teams
A full ransomware tabletop walkthrough: injects, decision points, and facilitation notes—built to surface payment authority, backup trust, HIPAA-style timelines, media pressure, and recovery tradeoffs.
Read Article
MSSP Guide: Delivering Tabletop Exercises to Clients at Scale
How MSSPs and vCISOs can package tabletop exercises as a repeatable service: template libraries, light customization per client, facilitation rhythm, and pricing tiers—without a custom doc for every engagement.
Read Article
Executive Cyber Crisis Drill: Board-Ready Simulation Guide for IT Leaders
Design and run executive cyber crisis drills: length, scenario choice, decision-focused injects, facilitation tips, and what usually breaks first—without turning the room into a technical deep dive.
Read ArticleScenario Library Spotlights
Explore interactive cyber crisis scenarios from our library.
Clara Talks Too Much: AI Agent Breach at Calder Ridge Bank
An extortion group claims it stole data on 500,000 customers from Calder Ridge Bank. The source turns out to be the bank's own customer-service AI agent, which cuts call volume by 60%. Executives must weigh containment against service collapse while managing regulator clocks, ransom posture, a fraud wave aimed at customers and a board divided over the AI program.
Voice Phishing Campaign Targeting Bank Customers
A sophisticated voice phishing (vishing) campaign has compromised customer credentials through fake promotional calls, resulting in $2M+ in unauthorized IVR transactions. With 500M ILS processed daily through the IVR channel and the attack scope still unknown, executive leadership must make critical decisions about incident response, customer protection, regulatory compliance, and business continuity under intense time pressure.
Fraud campaign
A sophisticated phishing campaign targets your financial institution's high-value clients, resulting in unauthorized wire transfers. Navigate regulatory notifications, client communications, and operational response while managing reputational damage and potential regulatory sanctions.
CEO Deepfake
A sophisticated business email compromise (BEC) attack using AI voice cloning technology to impersonate executives and authorize fraudulent wire transfers. Players must navigate detection, response, and recovery decisions while managing regulatory, reputational, and financial impacts in a high-pressure environment.
Trusted Vendor, Untrusted Update
A sophisticated supply chain attack targeting a major bank through a compromised third-party banking software update. Exercise participants must navigate critical decisions about vendor isolation, regulatory compliance, customer communications, and business continuity while managing an advanced persistent threat that has infiltrated core banking systems.
The "Bank of the South" (March 2025)
A sophisticated multi-month APT campaign targeting a major financial institution. The Codebreakers collective uses phishing to establish persistence, exfiltrate 1M customer records, deploy ransomware, and leak high-net-worth client data when ransom demands are refused. This expert-level scenario challenges C-suite executives with complex decisions around crisis communications, regulatory compliance, business continuity, and stakeholder management during a catastrophic cyber incident.
Ready to Build Your First Exercise?
Use our free scenario builder to create custom cyber tabletop exercises in minutes