incident-response:~$ ./tabletop --mode interactive

Turn incident response knowledge into repeatable tabletop exercises

Build realistic cyber crisis exercises from real attack patterns. Run your team through time-pressured decisions with branching consequences. Document everything automatically.

cyberwar24 — exercise-runner

$ Loading scenario: ransomware-lockbit-v3

[INFO] Scenario loaded — 12 nodes, 5 decision points, 3 endings

[INFO] Attack pattern: MITRE ATT&CK T1486, T1490, T1027

[ALERT] SOC analyst detects anomalous encryption activity on FILESRV-02

[DECISION] Isolate affected subnet? [Y/n] _

50+

Pre-built IR scenarios

100%

Real-world attack patterns

5 min

Custom scenario creation

360°

After-action coverage

Follow the incident lifecycle

Exercises mirror real IR workflows — from initial detection through recovery and lessons learned.

DETECT

Operational Realism

Scenarios built from real attack patterns — not theoretical what-ifs. MITRE ATT&CK-aligned decision points with realistic IOCs, escalation triggers, and time pressure.

Real-world attack TTPsTime-pressured decisionsEscalation triggers
ASSESS

Scenario Library

Over 50 pre-built scenarios covering ransomware, supply chain, BEC, insider threats, and APT campaigns. Each modeled on documented incidents and adapted for training.

50+ pre-built scenariosMultiple attack typesIndustry-specific variants
RESPOND

Consequence Mapping

Every decision branches into consequences. See how containment choices affect blast radius, recovery time, and business impact in real time.

Decision branchingImpact scoringBlast radius modeling
RECOVER

Post-Exercise Documentation

Automated after-action reports with gap analysis, response timeline, decision audit trail, and prioritized remediation recommendations.

Gap analysisDecision audit trailRemediation priorities

Ready-to-run scenario library

Start with proven scenarios modeled on real-world incidents, or build your own from scratch with AI.

Advanced

Ransomware (LockBit)

Ransomware

Expert

SolarWinds-style Supply Chain

Supply Chain

Moderate

Business Email Compromise

BEC

Advanced

Insider Threat - Data Exfil

Insider

Advanced

Healthcare Ransomware

Ransomware

Expert

Cloud Infrastructure Breach

Cloud

How a branching exercise works

Incident Detected

DECISION POINT

Isolate affected systems or continue monitoring?

Isolate

Limits spread, but alerts attacker

Contained: 3 systems affected

Monitor

Gathers intel, but risk of spread

Spread: 12 systems encrypted

Ready to run your team through a real-world scenario?

Pick a pre-built exercise or create a custom one with AI in under 5 minutes.