These are tabletop exercise examples and crisis scenarios we have designed and run for clients: representative, not exhaustive. Almost no firm publishes its scenario catalog. We do, because the scenario isn’t the secret. The design and facilitation are. Every engagement starts from your organization, your industry, and your actual dependencies, whether the starting point is one of these or a scenario built from scratch.
Cyber
The scenarios that put security, legal, communications, and leadership in the same fight. Most run as tabletops or full simulations with injects through your real channels.
Ransomware and Double Extortion
A financially motivated group encrypts systems after stealing data, then squeezes: a ransom demand with a deadline, a leak site, and pressure applied to your customers. Your team faces the pay-or-refuse call with a live negotiation running.
Runs as cyber tabletop · simulation · executive exercise
AI-Accelerated Vulnerability StormNew
An open-weights AI model starts finding and chaining vulnerabilities faster than anyone can patch, and disclosures spike with real findings buried in AI-generated noise. The storm hits your products, your infrastructure, and your vendors at once. We delivered the first commercial version of this exercise.
Runs as AI crisis exercise · simulation
Cloud Provider Outage
A major cloud region goes dark, and with it your customer-facing services. The exercise tests recovery decisions under uncertainty: wait for the provider, fail over at cost, or communicate a timeline you can’t control.
Runs as cyber tabletop · continuity exercise
Third-Party Software Compromise
A vendor’s compromised update moves into your environment before anyone knows it is malicious. Tests detection, vendor communications, and the awkward reality of incident response inside software you didn’t write.
Runs as cyber tabletop · third-party exercise
Privacy & Data
Where the incident is measured in records, regulators, and notification clocks, not just downtime.
Data Breach and Disclosure
Confirmed exfiltration of customer data starts the clock: forensics under privilege, notification obligations across jurisdictions, credit monitoring, and the decision of when to say what, publicly.
Runs as cyber tabletop · executive exercise
Privacy Incident and Regulatory Notification
A privacy failure that never touches a hacker: misdirected data, an access-control gap, a vendor’s mistake. Tests the privacy incident process, HIPAA and state timelines, and coordination between privacy, legal, and the business.
Runs as tabletop
Third-Party Data Breach
Your customers’ data breached at someone else’s company. Tests contract levers, joint notification decisions, and communicating about an incident you didn’t cause but still own.
Runs as third-party exercise · tabletop
Physical
People-first scenarios where minutes matter and leadership decisions carry human weight.
Active Shooter
An armed intruder at a facility. Tests emergency communications, law enforcement coordination, accountability for your people, family notification, and the leadership decisions in the hours and days after.
Runs as tabletop · executive exercise
Workplace Violence
A credible threat inside the organization: an escalating termination, a protective order, a threatening message. Tests threat assessment, HR and legal coordination, and protective measures short of crisis.
Runs as tabletop
Mass Casualty Incident
An event that overwhelms normal capacity, built for healthcare systems and large-venue operators. Tests surge, triage, systemwide coordination, and communications when families and media arrive together.
Runs as tabletop · simulation
Corporate Aviation Disaster
An aircraft carrying your executives goes down. Tests succession, notification, market disclosure, and running the company through grief, all at once.
Runs as executive exercise · tabletop
Natural
All-hazards scenarios we have run against real geographies: sites, regions, and the people who work in them.
Hurricane, Typhoon, and Severe Weather
A named storm with a forecast cone over your operations. Tests the decisions with lead time: when to close, when to evacuate, how to protect people and restart the business behind the storm.
Runs as tabletop · simulation
Tornado
No lead time at all: a strike on a site during working hours. Tests shelter procedures, accountability, damage assessment, and continuity when a facility is simply gone.
Runs as tabletop · simulation
Winter Storm
Ice, snow, and cold that close roads, strain power, and stretch across days. Tests staffing decisions, essential operations, and the cumulative grind that short exercises miss.
Runs as tabletop · continuity exercise
Wildfire and Regional Power Loss
Fire, smoke, evacuation zones, and public safety power shutoffs, or a grid failure standing alone. Tests remote-work capacity, site interdependencies, and operating dark for longer than the plan assumed.
Runs as continuity exercise · tabletop
Reputational
Crises where the damage moves at the speed of a feed, and the response is measured in judgment, not systems.
Viral Misinformation
A false claim about your company catches fire online, and the correction travels slower than the lie. Tests monitoring, response thresholds, and the discipline of not making it worse.
Runs as tabletop
Deepfake of a Senior Leader
A convincing fake of your CEO says something that moves markets, money, or employees. Tests verification protocols, platform takedowns, and reasserting the truth when seeing is no longer believing.
Runs as AI crisis exercise · executive exercise
Executive Misconduct
A credible allegation against a senior leader. Tests investigation under privilege, board involvement, communications, and the governance seams that only show under this specific pressure.
Runs as executive exercise
Franchisee Misconduct
A franchisee’s actions become the brand’s crisis overnight. Tests the levers you actually have, the ones you don’t, and protecting a system of operators from one operator’s conduct.
Runs as tabletop · simulation
Operational & Product
When the thing you make, serve, or ship becomes the crisis.
Product Recall and Contamination
A product safety issue reaches customers before it reaches your dashboard. Tests recall decision-making, regulatory notification, retail and distributor coordination, and the customer-facing response.
Runs as tabletop · simulation
Food Safety Incident
Illness reports, an off-taste complaint, or a contamination signal in a food operation. Tests traceability, hold-and-withdraw decisions, health authority coordination, and franchise or multi-site communications.
Runs as tabletop · simulation
Manufacturing Disruption
A production line, plant, or process goes down hard: equipment failure, industrial accident, or utility loss. Tests recovery sequencing, customer allocation decisions, and the gap between engineering’s timeline and sales’ promises.
Runs as continuity exercise · tabletop
Supply Chain & Third Party
The dependencies you don’t control, tested before they fail. Some of these run jointly, with your vendor in the exercise.
Critical Vendor Failure
The platform, processor, or provider your operation stands on goes down or goes under. Tests workarounds, contract levers, alternate suppliers, and customer communications when the cause isn’t yours but the impact is.
Runs as third-party exercise · tabletop
Business Process Outsourcing Failure
Your BPO stops mid-cycle: an outage, an incident, or a collapse. Tests how fast you detect it, what you can bring back in-house, and what you tell the customers whose transactions are in flight.
Runs as third-party exercise · simulation
Logistics Disruption
A port closure, carrier failure, or route disruption strands your inbound or outbound flow. Tests allocation, rerouting, customer prioritization, and the cost decisions that come with every workaround.
Runs as continuity exercise · tabletop
Sole-Source Supplier Loss
The one supplier nobody ever qualified a backup for is gone. Tests the honest math of requalification timelines, inventory runway, and which customers get what’s left.
Runs as third-party exercise · tabletop
Financial & Regulatory
The crises boards report facing most at private companies, and the ones plans cover least.
Regulatory Investigation
An inquiry arrives, sometimes alongside another crisis already in motion. Tests legal coordination, document holds, employee communications, and running the business while answering for it.
Runs as executive exercise · tabletop
Major Litigation
A lawsuit large enough to threaten the enterprise, filed publicly. Tests privilege discipline, disclosure decisions, and keeping the organization focused while the story writes itself.
Runs as executive exercise
Payment Systems Failure
You can’t pay, get paid, or make payroll. Tests treasury workarounds, bank and processor escalation, and the communications that keep employees and vendors calm while the pipes are down.
Runs as continuity exercise · tabletop
Don’t see your scenario? That’s the point.
Every exercise we deliver is custom-built from your organization, your industry, and the threats that actually keep your team up at night.