TL;DR
- Another simulated phishing email won’t tell you much you don’t already know. A tabletop exercise will.
- Oh Noes!, our incident response tabletop game, is now free to download with no form required.
- Get the Oh Noes! kit—Incident Master Guide, character sheets, and scenarios included.
Another phishing test isn’t going to teach anyone anything new
October means Cybersecurity Awareness Month, which for a lot of security teams means the same routine: send a fake phishing email, see who clicks, remind everyone not to click links from strangers. Again.
Phishing simulations still have a place, they just don’t test what breaks during a real incident. You also have to test your team’s communication, decision-making under pressure, and whether the team knows the plan or is improvising it live—that’s how you prepare for a real incident.
That’s what a tabletop exercise is for—all you need is the free download and two hours blocked off for a fun (and insightful) breach simulation exercise.
Oh Noes! just lost its gate
We built Oh Noes! as a tabletop RPG for security teams, in the style of Dungeons & Dragons. You create characters, an Incident Master runs a cybersecurity incident scenario specific to your org, and the group works through it together, role-playing the response in real time.
We updated Oh Noes! recently for DEF CON in August, but we only had exclusive physical copies at that time. Now, you can download the updated game, with scenarios built for the AI landscape. And with the update, we’ve also provided you with two types of scenarios: those needed for breach simulation, and the alternative versions for red teams.
Oh Noes! was previously accessible with email, but this Cybersecurity Awareness Month, we dropped that step. Click, download, gather your team, and start playing—no form fill required.
What’s in the kit
- The Incident Master Guide, which runs the scenario (think Dungeon Master Guide, but for incident response)
- A blank character sheet for each player
- A scenario guide with sample cybersecurity incidents to get you started
- An editable sheet for building scenarios specific to your own organization
Run it this month
Cybersecurity Awareness Month works best when it actually changes behavior, not when it’s a compliance checkbox. Get the whole security team in a room, pick a scenario, and find out where your incident response plan actually holds up. Want to test something specific? Write your own scenario and test that, too!
Frequently asked questions
What is Oh Noes!?
Oh Noes! is Expel’s incident response tabletop game, built on the same bones as role-playing games like Dungeons & Dragons. Your team creates characters and role-plays through cybersecurity incidents specific to your organization.
Do I need to fill out a form to download Oh Noes!?
No. The kit is free and ungated—no form, no email required.
What's included in the Oh Noes! kit?
The Incident Master Guide, a blank character sheet, a scenario guide with sample incidents, and an editable sheet for building your own scenarios.
Why run a tabletop exercise instead of a phishing simulation during Cybersecurity Awareness Month?
A phishing test tells you who clicked a link. A tabletop exercise tests whether your team knows what to do once an incident is already underway, which is a different and more useful question.
