Abstract: Methods and apparatus are disclosed for developing scenarios for cyber exercises useful for evaluating the ability of an organization's infrastructure to handle situational anomalies. The methods and apparatus facilitate identification of a plurality of cyber elements, a plurality of participants, and a plurality of objectives for the exercise scenario. A gamespace is then created for the exercise scenario including an information technology topology and a transaction topology. Preferably, a hierarchical process is used to develop the cyber elements of the exercise scenario including defining a high level problem chain, a detailed problem chain, and a master scenario events list. The method and apparatus are capable of supporting a complex and dynamically changing environment having at least one player in a scenario-based exercise.