Summary
CyberTabletop is an agentic AI cybersecurity tabletop platform for running live, scored incident response exercises.
It helps security teams move beyond static slide decks by combining AI-generated scenarios, adaptive injects, role-based player decisions, facilitator controls, real-time scoring, and structured debriefs.
Use it to rehearse ransomware, business email compromise, data breach, insider threat, DDoS, supply-chain, cloud, and custom cyber crisis scenarios with participants joining from their own devices.
Agentic AI Exercise Engine
CyberTabletop can act as an AI exercise designer, adaptive inject generator, and simulation partner while keeping a facilitator in control.
- Facilitator-in-the-loop controls keep humans responsible for pacing, review, scoring, and debrief.
- AI Generated mode creates a complete scripted tabletop exercise before launch. Pick the incident type, difficulty, number of rounds, and organization context; CyberTabletop generates a reusable scenario for facilitator revie
- AI-Driven mode runs a fully adaptive exercise. The app generates injects during the live session based on the scenario configuration, facilitator context, and team decisions.
- Organization-aware prompts let admins provide business context so generated exercises feel closer to the environment being trained.
- Provider flexibility supports Anthropic Claude, Ollama, and deterministic scripted content. Ollama can support private/local model workflows.
Why It Is Different
Traditional tabletop exercises are often slide decks and discussion notes. CyberTabletop turns the exercise into an interactive cyber simulation workspace:
- facilitators launch live sessions with join codes and role assignments,
- players make decisions from their own devices,
- injects advance the incident over time,
- scoring and response distribution show how the team reacted,
- debriefs connect decisions to lessons learned and NIST CSF-oriented gaps,
Features
AI Exercise Design
- AI Generated and AI-Driven session modes
- Anthropic Claude and Ollama provider support
- Admin-editable AI prompts and provider configuration
- Organization context for more realistic scenario generation
- Deterministic scripted mode for built-in content and offline fallback
Live Tabletop Operations
- Facilitated sessions with lobby, join codes, and role assignment
- Role-based player decisions for incident response teams
- Built-in ransomware, BEC, DDoS, data breach, insider threat, APT, and supply-chain scenarios
- Scenario builder for custom phases, injects, and decision options
- Real-time facilitator controls for presenting injects and revealing outcomes
Scoring and Debrief
- Real-time scoring, leaderboard, response distribution, and scripted feedback
- NIST CSF-oriented debrief and gap-analysis outputs
- Decision history for after-action discussion
- Structured debrief workflow for turning exercise observations into improvements
Security and Operations
- Local authentication plus optional OIDC/SSO
- Enforced TOTP MFA for privileged roles, with optional MFA for players
- Role-based authorization and SOC-style audit logging
- Admin security dashboard for operational posture checks
- Docker Compose deployment with PostgreSQL, Redis, frontend, backend, and Nginx
- SBOMs, Docker Scout review notes, and release-hardening documentation