Tabletop simulator — cybersecurity
A tabletop simulator for cyber incident response
Looking for the board-game sandbox? That is a different product. TableTop Sim simulates cybersecurity incidents for executive and technical teams: staged injects, a seat for every role, a facilitator control room, and an after-action report at the end of the session.
Disambiguation
Two very different things called a tabletop simulator
If you arrived here looking for miniatures and dice, we are not it — and we would rather say so up front.
| Board-game tabletop simulators | TableTop Sim | |
|---|---|---|
| Purpose | Play physical board games online | Rehearse cybersecurity incident response |
| Users | Gamers | vCISOs, MSSPs, consultants, internal security teams |
| Content | Game assets and mods | Cyber scenarios, staged injects, technical artefacts |
| Output | A finished game | An after-action report with owned, dated actions |
| Access | Desktop install | Browser; participants join with a code |
Simulation model
What gets simulated
A cyber tabletop simulator is only useful if the pressure is real. Four things create it.
Information asymmetry
Each seat gets its own brief and private information. The CEO does not see what Legal sees, which is exactly how real incidents go wrong.
A shared clock
A visible countdown per inject changes behaviour more than any narrative device. The facilitator can pause it deliberately.
Consequence
Injects respond to what the room actually said — including an AI-improvised inject built from a commitment someone just made out loud.
A record
Every decision is timestamped and attributed to a seat, which is what makes the after-action report defensible.
Participant simulation
Every seat simulates a different room
Switch seats below to see how the same incident reads from four chairs.
Your seat
CEO — Priya S.
- Detection
- Triage
- Containment
- Escalation & Notification
- Eradication & Recovery
- Public & Legal
- Recovery & Lessons
Your brief
You own the trading decision. Every hour of ERP downtime costs roughly one day of margin recovery, and your board chair will ask what you knew and when.
Private to this seat
Private to you: the board's risk committee meets tomorrow morning. Your cyber policy has a 24-hour notification clause you have not yet triggered.
No other participant can see this panel
Do you keep shipping running while the blast radius is still unknown?
Shared situation board
- 00:04another role's lane
CISO received new information
- 00:11another role's lane
IT Operations received new information
- 00:23your lane
The CFO asks whether to shut down the ERP
On the bridge
- Priya S.CEO
- Dana W.CISO
- Alan R.General Counsel
- Lena K.Comms Director
- R. Alvarezobserver
- T. Okaforobserver
Environment simulation
Simulate their environment, not a generic company
Pick a profile and tailor the scenario to watch the same inject change shape.
Client environment
Library inject — before
Helpdesk escalation: three users locked out of the finance share
Two accounts payable clerks and a controller report that files on the finance share now end in .nwlk and open as gibberish. A README appears in every folder. The helpdesk has already rebooted one machine.
Helpdesk escalation: three users at your largest client are locked out of the finance share — and the same RMM agent version is deployed across 40 tenants. The README references your company name, not the client's.
The inject now tests tenant isolation, RMM credential hygiene, and how you notify 40 clients at once.
AI-improvised inject
CEO: "We're not paying anything, and I want that in writing to the whole company today."
FAQ
Questions about cyber tabletop simulators
- Is this the same as Tabletop Simulator, the board-game software?
- No. Tabletop Simulator on Steam is a physics sandbox for playing board games. TableTop Sim is a cybersecurity tabletop exercise platform: it runs incident-response exercises for executive and technical teams, with staged injects, role-based views and an after-action report.
- What does a cybersecurity tabletop simulator do?
- It replaces the slide deck and spreadsheet that most facilitators use. Scenarios and injects are stored and staged, participants join a role-specific view, the facilitator releases injects and controls a shared clock, every decision is logged with a timestamp, and the platform drafts the after-action report from that record.
- Do participants need to install anything or create accounts?
- No. Participants join with a code in a browser. Only facilitators need accounts.
- Can we simulate our own environment rather than a generic company?
- Yes. Describe the client's environment once — cloud or hybrid, device estate, sector, regulators, data types — and injects, artefacts and role prompts are rewritten around it.
- Can it run remote, in-person or hybrid exercises?
- All three. Remote participants each use their own screen; in-person rooms often project the situation board while participants use laptops or phones for their private role views.