TableTop Sim

Interactive product tour

Get the feel of the tool before you book anyone's calendar

These are working mock-ups of the real TableTop Sim screens, loaded with a sample ransomware exercise. Nothing here writes to a live exercise — click anything.

Start free trialFull feature breakdown

Facilitator console

Run the room from one screen

Release the next inject, hold the clock while a decision is still being argued, and read responses as each seat submits them. Press start, then release an inject and watch the feed fill.

console.tabletopsim.com — Ransomware in the finance shared drive
03:00

Inject window

Northwind Logistics · Ransomware · Standard

9 / 9 connected
  1. Detection
  2. Triage
  3. Containment
  4. Escalation & Notification
  5. Eradication & Recovery
  6. Public & Legal
  7. Recovery & Lessons
On airstandardCISO laneresponse required

Helpdesk escalation: three users locked out of the finance share

Two accounts payable clerks and a controller report that files on the finance share now end in .nwlk and open as gibberish. A README appears in every folder. The helpdesk has already rebooted one machine.

Inject timeline

  1. 00:04Helpdesk escalation: three users locked out of the finance sharereleased · CISO
  2. 00:11EDR timeline: service account authenticated from an unmanaged hostqueued · IT Operations
  3. 00:23The CFO asks whether to shut down the ERPqueued · CEO
  4. 00:34A customer emails a screenshot of your data on a leak sitequeued · General Counsel
  5. 00:48Trade press calls for comment before your statement is readyqueued · Comms Director

Live response feed

  1. 00:06CISO

    Isolating FILE-02 and the three endpoints now. Do not reboot anything else — we need the volatile evidence.

    Dana W.

Start the clock to watch responses land

Run this exercise with your own client

The trial includes the full scenario library, unlimited participants and a real after-action report.

Start free trialView pricing