Free Cybersecurity Tabletop Tool

Run better exercises.
Find the gaps before attackers do.

Eight ready-to-run scenarios — including DFARS/CUI breach and C-TPAT cross-border disruption scenarios you won't find anywhere else — plus Claude AI-generated exercises customized to your organization. Free, browser-based, no account required.

▶ Start a Tabletop See the 8 scenarios
TABLETOP EXERCISE — IN PROGRESS
Scenario 6: DFARS / CUI Breach
Phase 2 — Containment & Escalation
Inject #3 — T+90 min
DCSA is on the line. Your FSO needs to know: was CUI stored on the system that was accessed? Your SSP says no, but your IT team isn't sure.
Who has authority to confirm CUI scope right now?
Does the 72-hour DFARS reporting clock start now?
Team is unclear on SPRS impact — document as gap
3 / 12 injects
● Exercise live
🔒Browser-based, no login
🤖AI scenario generation
🏆8 ready-to-run scenarios
📄Branded after-action report
$Free — always
Exercise Library

8 pre-built scenarios for your clients

Built for TRA's actual client base: defense contractors, maquiladoras, SoCal/Baja companies, and mid-market organizations. Two scenarios exist nowhere else at any price.

🔒
1 — Ransomware with Data Exfiltration
Who authorizes taking systems offline? Do you pay? When do you notify customers? The DFARS 72-hour clock starts ticking.
Any sector 2.5–3 hrs
📧
2 — Business Email Compromise
A wire transfer goes out to the wrong account. Vendor impersonation discovered. Finance, IT, and legal need to coordinate immediately.
Any sector 1.5–2 hrs
☁
3 — Cloud / M365 Account Compromise
Azure AD takeover. Email forwarding rules discovered. How far did the attacker get, and how do you know?
Any sector 2–2.5 hrs
👥
4 — Supply Chain / SaaS Vendor Breach
Your SaaS vendor was breached. Unknown blast radius. What are your contractual obligations to customers?
Any sector 2–2.5 hrs
🕵
5 — Insider Threat
Privileged access abuse discovered weeks after the fact. HR, Legal, IT, and executives all need to be in the room — but should they all know the same things?
Any sector 2–2.5 hrs
🏰
6 — DFARS / CUI Breach
CUI found on an uncontrolled system. The 72-hour DoD reporting clock is running. SPRS implications, C3PAO notification, SSP gaps surface in real time.
Defense contractors 2.5–3 hrs
🚚
7 — C-TPAT / Cross-Border Disruption
Cargo tampering discovered at a border crossing. CBP notification, chain of custody, carrier liability — and the clock is ticking on your C-TPAT status.
Maquiladoras / Logistics 2–2.5 hrs
🤖
8 — AI-Assisted Phishing / Deepfake Exec
A synthesized voice call impersonating your CFO triggers a wire fraud attempt. How does your team verify identity when the voice sounds real?
Finance / Legal / HR 1.5–2 hrs
✨
+ AI-Generated Custom Scenario
Fill in your organization's profile — sector, size, systems, IR maturity, key roles — and Claude generates a fully tailored scenario with injects, discussion questions, and decision points. Bring your own Claude API key (BYOK). The scenario stays in your browser; nothing is sent to TRA.
Process

How a TRA tabletop works

Designed for Thomas to run over Zoom, sharing his screen and driving the exercise. Participants watch and discuss; facilitator captures notes per inject.

⚙
Setup
Enter the org profile: name, sector, participants and roles, IR plan status. Select a fixed scenario or generate a custom AI scenario.
📝
Scenario Brief
Participants read the threat actor context and initial conditions. Sets the scene before the first inject.
▶
Exercise
Drive injects phase by phase. Capture facilitator notes per inject. Regulatory flags (DFARS 72-hr, HIPAA 60-day) surface automatically.
📄
After-Action Report
Notes compile into a branded PDF: gaps by phase, regulatory implications, recommended next steps with links to TRA tools.
Market Context

Free, where others charge $5K–$25K per engagement

Enterprise tabletop platforms are expensive, consultant-driven, and don't cover TRA's client base. This tool does — at zero cost.

Tool Cost AI Scenarios DFARS / C-TPAT Browser-based After-Action PDF
CISA CTEPsFree✗✗PDF download only✗
ThreatGEN AutoTableTop$$$, contact✓✗SaaS app✓
CrowdStrike TTX$5K–$25K✗✗Consultant-led✓
TRA Tabletop ToolFree✓✓ Both✓✓
Report Output

Every exercise ends with a client-ready report

Facilitator notes from each inject compile automatically into a structured after-action report. Export to PDF. TRA-branded, ready to deliver.

After-Action Report — Ransomware with Data Exfiltration
Acme Defense Group  |  July 28, 2026  |  Facilitator: Tom Andersen, CISSP/ISSMP
✓ Report ready
Phase 1 Gaps — Detection
No defined authority to isolate production systems without CIO approval
SIEM alert triage SLA undefined; team unsure who gets paged after hours
EDR coverage confirmed on workstations; servers not verified
IR Readiness Assessment
Phase 2 Gaps — Containment
DFARS 72-hr reporting clock — team unsure when it starts
Legal counsel not pre-retained; breach counsel contact unknown
Backup restoration time untested; RTO unknown
NIST 800-171 Assessment
Recommended Next Steps
Document isolation authority matrix before next exercise
Retain breach counsel and run notification deadline drill
Test backup restoration — document actual RTO vs. stated RTO
Schedule NIST 800-171 reassessment against IR control gaps found

Run your first tabletop today

No account. No installation. Works in any modern browser. Your exercise data stays on your machine.

▶ Launch the Tool Browse All Tools
Questions? Reach Tom Andersen at thomas@traconsulting.com
⚠ For facilitated exercise use only. Not a substitute for a formal IR program review or third-party security assessment. Exercise data stored locally in your browser.