20 Tabletop Exercise Examples for Cybersecurity Teams

Good tabletop exercise examples do one thing well: they force a specific, uncomfortable decision that your organisation has not yet made. Below are 20 cybersecurity tabletop exercise scenarios grouped into six categories, each with a short premise, the audience it suits, a difficulty level and the key decision it forces.

Fourteen of them have full, ready-to-run pages in the scenario library, with objectives, timed injects, discussion questions and evaluation criteria. The other six are idea-only: use them as seeds and build them out with the tabletop exercise template. If you are new to the format, start with what a tabletop exercise is.

Difficulty uses three levels: foundational (good first exercise, few prerequisites), intermediate (needs a working IR plan and some technical depth) and advanced (many parallel threads, regulatory pressure or safety stakes).

Ransomware and extortion

1. Double-extortion ransomware (full scenario)

Hypervisors are encrypted on a Friday night, stolen data appears on a leak site with a countdown, and the attacker opens a negotiation portal. Offline backups exist, but a full restore will take days.

• For: mixed technical and executive crisis team
• Difficulty: intermediate
• Key decision: who authorises taking the virtualisation platform offline, and how the organisation would decide on a ransom demand.
• Run it: ransomware tabletop scenario

2. Hospital ransomware and ambulance diversion (full scenario)

The electronic health record goes down, clinical systems degrade and paper downtime procedures have not been drilled in years. Patient safety, not data, drives every decision.

• For: hospital executives, clinical operations, legal
• Difficulty: advanced
• Key decision: when to divert ambulances and switch to downtime procedures, and who makes that call.
• Run it: healthcare ransomware tabletop

3. DDoS with an extortion demand (full scenario)

During peak season, the storefront and public API buckle under a multi-vector flood. Then an email arrives promising it will stop if you pay.

• For: operations, communications, executives
• Difficulty: foundational
• Key decision: how to prioritise traffic and customers while mitigation ramps up, and how to respond to the extortion email.
• Run it: DDoS attack tabletop

4. Backup failure during recovery (idea)

Mid-way through a ransomware recovery, the team discovers the most recent clean backups of the ERP database are corrupt, and the last good copy is three weeks old.

• For: IT operations, business owners, CIO
• Difficulty: intermediate
• Key decision: accept three weeks of data loss and rebuild transactions manually, or keep trying to recover newer data while the business stays down.

Email and identity

5. Business email compromise (full scenario)

A supplier's "new bank details" arrive from a compromised mailbox, and a large payment has already left. Finance and IT have hours to try to recall it.

• For: finance, IT, executives
• Difficulty: foundational
• Key decision: how fast the payment recall starts, and who owns it across finance, the bank and security.
• Run it: business email compromise tabletop

6. Phishing and session hijacking (full scenario)

An adversary-in-the-middle login page captures a session token and bypasses MFA. A mailbox rule hides the evidence, and the next phish comes from inside the organisation.

• For: security, IT, finance, communications
• Difficulty: foundational
• Key decision: how far to scope the compromise and whether to force a global session revocation.
• Run it: phishing credential theft tabletop

7. Identity provider takeover (full scenario)

MFA fatigue gives an attacker a super-admin account in your single sign-on platform. Every federated application now trusts them.

• For: security, identity and cloud engineers, executives
• Difficulty: advanced
• Key decision: whether to cut off SSO for the whole organisation to evict the attacker, knowing it stops the business.
• Run it: identity provider compromise tabletop

8. Deepfake executive fraud (full scenario)

The CFO joins a video call with the "CEO", who urgently needs a confidential transfer. The CEO was never on the call.

• For: finance, executives, communications
• Difficulty: foundational
• Key decision: which verification steps are mandatory for urgent executive requests, and who can override them.
• Run it: deepfake CEO fraud tabletop

9. Social-media account takeover (idea)

The company's main social account is hijacked and starts posting a fake product recall with a malicious link. The platform's support queue is slow and the account's recovery email belongs to a former agency.

• For: communications, marketing, security, legal
• Difficulty: foundational
• Key decision: how to warn customers through other channels, and who owns account recovery with the platform.

Cloud and third parties

10. Cloud access key leak (full scenario)

A long-lived access key is pushed to a public repository. A billing spike follows, and storage buckets are being listed.

• For: cloud, platform and security engineers
• Difficulty: intermediate
• Key decision: revoke the key immediately and break production workloads, or rotate carefully while the attacker keeps access.
• Run it: cloud access key leak tabletop

11. Software supply-chain compromise (full scenario)

A trusted vendor's signed update was trojanised and is installed on hundreds of your machines.

• For: security, IT, executives, communications
• Difficulty: advanced
• Key decision: whether to pull a business-critical tool from every endpoint before the vendor confirms the scope.
• Run it: supply-chain compromise tabletop

12. Third-party vendor breach (full scenario)

Your file-transfer provider was mass-exploited. Your customers' data sat on its servers, and you learn about it from the news.

• For: legal, vendor management, executives, security
• Difficulty: intermediate
• Key decision: whether you, as controller, must notify regulators and customers before the vendor gives you facts.
• Run it: third-party vendor breach tabletop

13. Cloud provider region outage (idea)

Your primary cloud region suffers a prolonged outage unrelated to any attack. Failover to the secondary region has been designed but never run in production.

• For: platform engineering, operations, business owners
• Difficulty: intermediate
• Key decision: when to trigger an untested failover, and which services to sacrifice to protect the critical ones.

Data and privacy

14. Data breach and regulatory notification (full scenario)

Customer personal data is confirmed exfiltrated. GDPR, NIS2 and SEC clocks start running in parallel, with incomplete facts.

• For: legal, privacy, executives, communications
• Difficulty: advanced
• Key decision: what to notify, to whom and when, while the investigation is still changing the picture.
• Run it: data breach notification tabletop

15. Lost unencrypted laptop (full scenario)

A laptop disappears from a car overnight. Nobody is sure what was on it, or whether disk encryption was enabled.

• For: legal, HR, IT
• Difficulty: foundational
• Key decision: whether the loss is a notifiable personal-data breach, based on what you can actually prove.
• Run it: lost laptop data breach tabletop

16. Departing insider (full scenario)

A privileged engineer resigns and gigabytes flow to personal cloud storage. HR, legal and security have to act together without tipping them off.

• For: HR, legal, security
• Difficulty: intermediate
• Key decision: when to revoke access and confront the employee, and how to preserve evidence lawfully.
• Run it: insider threat tabletop

Availability and operations

17. OT / ICS plant intrusion (full scenario)

Ransomware is spreading in the corporate network, and an operator screen on the plant floor starts behaving oddly.

• For: plant operations, OT and IT security, executives
• Difficulty: advanced
• Key decision: whether to stop the production line pre-emptively before safety is at stake.
• Run it: OT/ICS incident tabletop

18. Domain and DNS hijack (idea)

An attacker gains access to your domain registrar account and repoints DNS for the main website and mail. Customers land on a lookalike page; inbound email is silently intercepted.

• For: IT, security, communications, legal
• Difficulty: intermediate
• Key decision: who holds registrar credentials and recovery rights, and how you tell customers which messages to trust.

People and emerging threats

19. Critical zero-day patch race (idea)

A critical vulnerability in an internet-facing appliance is published with exploit code. The vendor patch requires downtime, and you cannot yet tell whether you were compromised before patching.

• For: security, IT operations, change management, business owners
• Difficulty: intermediate
• Key decision: take the service offline now, or patch in the next window and hunt for signs of earlier compromise.

20. Physical intrusion into a server room (idea)

Access logs show an after-hours entry to the server room using a contractor badge. A small device is found plugged into a network switch.

• For: facilities, physical security, IT, HR, legal
• Difficulty: foundational
• Key decision: whether to treat it as a full cyber incident, and who leads when physical and IT security both own part of it.

Which scenario for which audience

How to pick the right example

1. Start from objectives, not the threat. Decide what you need to learn: who authorises shutdowns, how notification decisions are made, whether finance controls hold. Then pick the scenario that forces that decision.
2. Match the audience. Executives need business decisions, not packet captures. Technical teams need enough detail to discuss real containment options.
3. Use your risk register and recent near-misses. A scenario that mirrors something that nearly happened last quarter gets full attention.
4. Start foundational. A first exercise that goes well builds appetite for harder ones. Save advanced scenarios for teams that have run at least one tabletop.
5. Tailor the details. Replace generic names with your real systems, suppliers and teams. The guide to designing injects shows how.
6. Rotate over the year. Cover at least one scenario from four of the six categories annually so no part of the response goes unexercised.

Once you have chosen, prepare the discussion prompts from the tabletop exercise questions bank. Any of the fourteen full scenarios can be run directly in the site's live exercise runner, which releases injects to players' phones and exports the after-action report; its scenario builder also lets you turn one of the six idea-only examples into a full exercise.

Related

• What is a tabletop exercise?
• How to run a tabletop exercise
• Tabletop exercise template
• Designing tabletop injects and the MSEL
• Scenario library