What's in a TabletopSec Kit?
Everything you need to run professional security exercises
Scenario Dice
6 custom dice generate incident parameters: impact, priority, attack vector, scope, timeline, and cost.
Role & Asset Tokens
Color-coded tokens for positions, risks, mitigations, assets, and actions. Build your scenario visually.
Token Tray
Organized play surface keeps your exercise running smoothly. Categories stay separated.
Storage Canister
Keep everything together. Grab-and-go for offsite exercises and client engagements.
Legend Card
Quick reference for all dice faces and token categories. QR code links to digital scenarios.
Digital Scenarios
QR links to our scenario library. Pre-built exercises with facilitator guides and injects.
🎲 The Dice System
6 dice set the how — tokens set the what
D4 — Impact
Low • Medium • High • Catastrophic
D20 — Priority
P5 → P1 → Critical (weighted)
D10 — Vector
Email • Web • USB • Cloud • Insider • Supply Chain • RDP • VPN • Mobile • IoT
D8 — Scope
1% → 100% of environment
D6 — Timeline
1hr • 24hr • 1wk • 1mo • 6mo • 1yr
D12 — Cost
$1K → $1B exposure
🎖️ The Token System
8 categories bring scenarios to life
Positions
CISO • CIO • CFO • SOC • IR Lead • Forensics • Legal • Law Enforcement • Help Desk • Vendor • Pentest
Assign roles to exercise participants
Risks
Ransomware • Phishing • Insider Threat • DDoS • Supply Chain • Zero-Day • Account Takeover • Wiper • Shadow IT
Layer threat types onto scenarios
Mitigations
Firewall • SIEM • EDR • MFA • Backup • WAF • SOAR • Deception • Threat Intel • PAM • Email Security
What defenses are available?
Assets
Server • Database • Cloud • Endpoint • Active Directory • IoT • SCADA • WiFi • CI/CD • Containers • Cameras
What's at risk in this scenario?
Actions
Detect • Contain • Recover • Escalate • Pay / Don't Pay • Engage LE • Quarantine • Threat Hunt • Patch Now • Reset Passwords
Track IR lifecycle & make the hard calls
Compliance
NIST • HIPAA • PCI-DSS • GDPR • CMMC • SOC2 • SOX • FedRAMP • PHI • PII • CUI • GRC • BCP
Map frameworks, data types & governance
Impact
Downtime • Data Loss • Fine • Lawsuit • Rep Damage • Customer Churn • Stock Drop • IP Theft • Media Crisis
The "so what?" — business consequences on the table
Timeframes
Hour 1 • Day 1 • Week 1 • Triage • Investigate • Respond • Stabilize • Active • Inject • Hotwash
Pace the exercise & track IR phases
Full Token Library
How It Works
Roll the Dice
6 custom dice set the severity, attack vector, scope, timeline, and cost. Every roll is a unique incident.
Draw Tokens
8 color-coded categories: who's in the room, what's under attack, what defenses exist, which regulations apply, and what's at stake.
Run the Exercise
Use timeline tokens to pace the incident. Drop injects to escalate. Present decision tokens when it's time for the hard calls.
Debrief & Improve
Track impact consequences, review compliance gaps, and document lessons learned. Build muscle memory for the real thing.
Example Scenario
Result: Ransomware via RDP, 1-week dwell time, 50% of systems, $5M exposure. CISO and Legal are in the room. Backups exist but integrity unknown. What's your first move?
Try It Now
Roll the dice and see what scenario you get
20 Ready-to-Run Scenarios. 100 Drop-in Injects.
Stop building exercises from scratch. Our digital scenario library gives facilitators everything they need — just scan the QR code on the legend card and go.
Full Facilitator Scripts
Exactly what to read aloud, when to introduce injects, how to guide discussion. No prep work required.
Timed Injects
Realistic scenario escalation with reveal-one-at-a-time controls. "Hour 4: Attacker moves laterally to the finance subnet."
Decision Points
PAY or DON'T PAY? DISCLOSE or wait? Present the decision tokens and force the hard calls that make exercises valuable.
Debrief Templates
Post-exercise questions that surface real gaps: "When was the last time you verified your backups could actually restore?"
🎯 Expansion Packs
Specialized scenarios for compliance and advanced exercises
HIPAA Pack
Healthcare breach scenarios, PHI tokens, covered entity roles, breach notification timelines.
$39 18 tokensPCI-DSS Pack
Payment card scenarios, merchant levels, SAQ types, cardholder data tokens.
$35 16 tokensGDPR Pack
Data subject rights, cross-border transfers, DPA notifications, 72-hour scenarios.
$35 16 tokensCMMC Pack
Government contractor scenarios, CUI handling, NIST 800-171 controls.
$29 14 tokensRed Team Pack
Kill chain stages, TTPs, persistence mechanisms, adversary simulation.
$35 16 tokensRisk Assessment Pack
Likelihood/impact matrices, control effectiveness, quantitative risk tokens.
$29 14 tokensAI Threats Pack
Deepfake attacks, AI-powered phishing, prompt injection, voice cloning, shadow AI scenarios.
$35 16 tokensCloud Security Pack
Multi-cloud breaches, IAM key exposure, container escapes, SSO compromise, cloud-native threats.
$35 16 tokensICS/OT Pack
Critical infrastructure scenarios, PLC/SCADA attacks, safety system compromise, physical consequences.
$35 16 tokensShop TabletopSec Kits
Ultimate Pack
Everything you need for professional tabletop exercises
- ✓ 6 custom scenario dice
- ✓ 281 category tokens
- ✓ Premium token tray
- ✓ Storage canister
- ✓ Legend card with QR
- ✓ 20 ready-to-run scenarios
- ✓ Facilitator scripts & injects
Standard Pack
Core kit for regular exercises
- ✓ 6 custom scenario dice
- ✓ 106 category tokens
- ✓ Token tray
- ✓ Legend card with QR
- ✓ 20 ready-to-run scenarios
Starter Pack
Just the essentials
- ✓ 6 custom scenario dice
- ✓ 56 essential tokens
- ✓ Legend card with QR
- ✓ Storage pouch
- ✓ 20 ready-to-run scenarios
Individual Items
- Token Set Only$89
- Dice Set Only$49
- Legend Card$12
- Extra Token Tray$35
🔒 Secure checkout powered by Stripe
⚙️ Build Your Own Kit
Pick exactly what you need — no pack required
MSPs, VARs & Assessment Firms
You run tabletop exercises for your clients — we supply the kits at volume pricing
Volume Kit Pricing
White-Label Options
- Your logo on the legend card
- Co-branded storage canister
- Custom scenario library URL
- Client-facing facilitator guides
Built for Assessments
- Leave a kit with every client engagement
- Use during vCISO retainer exercises
- Compliance-ready documentation included
- Expansion packs for HIPAA, PCI, CMMC clients
Request Bulk Pricing
AI Scenario Generator
Roll the dice, get a complete scenario package: threat actor profile, IOCs, injects timeline, facilitator script, and debrief questions. Powered by AI.