PumaTTX helps you design incident-response tabletop exercises and generate the paper handouts that run them — facilitator guides, inject cards, participant briefs, and capture sheets. Discussion-based exercises are paper-first once in flight; this app produces that paper. No server, no account, no telemetry.
[COMPANY], [ERP SYSTEM] etc. once; every read-aloud and handout fills them in. Unresolved tokens are flagged so you customize before printing..pumapack to back up or share a scenario.New here? Read The method tab — it condenses the facilitator's craft.
A facilitated, discussion-based walkthrough of a hypothetical incident. Nobody touches a keyboard; the value is in the conversation. A tabletop tests whether your people, plans, and decisions hold up — not whether your technology works. Confusion in the room is the exercise working.
Manage attention, energy, and time — don't be the smartest person present. The core loop: present an inject → ask an opening question → let discussion run → probe the gaps → capture → release the next inject.
The trap for technical facilitators: the moment you answer your own questions, people stop thinking and wait for you. Hold your expertise back; let silence do the work.
Guard 20–30 minutes for it. Structure: reactions → what worked → what was hard → results against each objective → top three fixes. The lessons get locked in here — never let the scenario eat the debrief.
For the formal evaluation framework behind the AAR — objectives mapped to core capabilities, with the expected actions you assess against — see FEMA's HSEEP Exercise Evaluation Guides (EEGs). For ready-made cybersecurity scenario packages — inject sets, discussion questions, and facilitator guides you can adapt into PumaTTX exercises — see CISA's Tabletop Exercise Packages (CTEPs). Links in the README.
PumaTTX's data model is the eight reusable templates, mapped onto the lifecycle:
Framework vocabulary (HSEEP; NIST SP 800-61 / CSF 2.0) is noted on the AAR for auditors — the quality of the conversation matters more than the diagram you cite.
Every program is stored in your browser's localStorage, on this device and this browser only. Nothing is uploaded anywhere.
Danger zone. This erases every PumaTTX program in this browser. Export a backup first.
Type DELETE EVERYTHING to confirm:
.pumapack backupPumaTTX is a lightweight, portable, offline Tabletop Exercise (TTX) generator that runs entirely in your local browser. Build your scenarios in the app and it will generate a paper-based run packet, complete with facilitator guides and handouts.
This tool is provided as-is, with no warranties or guarantees. It is not professional advice. By using it you accept full responsibility for any outcomes that result from your use.
PumaWorx is a suite of offline, single-HTML productivity apps that run entirely in your local browser. The entire suite is a personal, open source vibecoding project.
This is an offline single-HTML app. No data goes to or from the internet — there is no server, no account, no sync, and no telemetry. Your exercises live in your web browser's localStorage — on this device, in this browser, and nowhere else.
If you clear site data, use a private/incognito window, switch browsers, or lose this device, your exercises are gone. Back up regularly with Export in the topbar — it produces a single .pumapack file with every program and exercise.
Press ? any time for help and the facilitator's method.