Cybrary ForgeCYBRARY / FORGE

Team tabletop exercises

Each tabletop is a full exercise: read the brief, work the cases, make the calls together, then sign off and record lessons learned. Play solo, or host a room and invite your team — AI teammates fill any empty seats.

Manager sign-offs: approve team closures
CP4-L2

The Compromised Agent

A planted intel advisory taught the enrichment agent that an attacker's range was a friendly scanner. For nine days the fleet closed its alerts as benign. You command the response with the team room.

4 seats: Incident Commander, Agent Operations, Evidence & Cases, Communications 120 min · advanced
CP4-L3

Ransomware Night

File servers at fourteen branches encrypted overnight and the recovery agent is already restoring from last night's backup. You command the response with a five-seat team: recover safely, rule on the ransom and tell the right people.

5 seats: Incident Commander, Recovery Lead, Forensics, Executive Liaison, Communications 120 min · advanced
CP4-L7

Cloud Key Leak

A developer's cloud key sat in a public code repository for four days before someone used it to launch mining servers and read customer statements. You command a three-seat team: cut off the key, keep the evidence and decide who must be told.

3 seats: Incident Commander, Cloud Engineer, Communications 90 min · intermediate
CP4-L5

Insider Data Theft

A relationship manager who resigned yesterday synced 3,900 client files to a personal drive and printed the contact sheets after hours. You lead a four-seat team with HR, legal and forensics: preserve the evidence, act proportionately and keep the process fair.

4 seats: Case Lead, HR Partner, Legal Counsel, Forensics 90 min · intermediate
CP4-L6

Supplier Breach

A trusted vendor's signed update for the branch queue software carried a backdoor, and the patch agent has already installed it at eleven branches. You command a four-seat team: stop the spread, cut the vendor's access and work out who else is hit.

4 seats: Incident Commander, Vendor Manager, Threat Hunter, Communications 120 min · advanced