A cybersecurity card game. Defend the school's data as the Blue Team, or test its defenses as an ethical hacker on the Red Team.
1 Choose a game mode
⚔️ Blue places barriers on the road; Red sends attacks down it. Survive 10 waves or fill the Trace meter (Blue), or take the Data to 0 (Red).
🔁 Battle rounds (10 waves each)
Continue with your cards, defenses, upgrades, resources and persistence intact. Up to 40 waves.
🧱 Blue lines up barriers (Red can scan the first 3), Red lines up attacks in order, then everything launches. Order matters!
💰 Blue gets a $20k security budget, Red gets $16k. Buy your kit from the full catalog (prices follow real-world costs), line it up, then launch.
2 Who are you playing against?
Opponent
Bot difficulty
3Pick your team
🛡️
Blue Team · Defense
Protect the school with firewalls, MFA, EDR, training, backups and more.
Win: survive, or trace the hacker
🕵️
Red Team · Offense
Play an ethical hacker hired to find the gaps in the school's defenses.
Win: take the Data to 0
🛣️The mapA road runs from the hacker to the school's data.
🛡️BluePlaces barriers that keep blocking matching attacks.
🕵️RedSends attacks down the road, looking for gaps.
💡LearnEvery block and hit explains the real-life security lesson.
📚 Full rules
🎮 Basics
The map shows a road from the hacker 🕵️ to the school's data 🗄️.
🛡️ Blue plays defense cards, which drop barriers on the road (up to 6). A barrier keeps stopping its matching attacks, like real security tools, until a bypass attack breaks it or Blue replaces it.
🕵️ Red plays attack cards. If no matching barrier is in the way, they hit the school's Data.
Each turn: draw a card, then play one (or discard). Blue goes first, then Red: that's one wave.
Blue wins by surviving 10 waves or filling the 🕵️ Trace meter (+3 per block). Red wins by taking the Data to 0.
🐢 Teach Mode pauses after every attack to explain it. Press Next ▶ (or Enter).
🛌 Sleeper Persistence
Red installs a dormant sleeper only while inside. Once installed it survives losing access.
Reactivate with 📱 Dead-Drop (+1), 🌐 New Domain (+2), or 📡 Special Packet (+3). No fresh initial access is needed.
Firewall with 🔬 Deep Inspection, DNS filtering, or 🏰 Hardened Firewall detects the new-domain trigger.
Blue needs TWO 🧹 Security Sweeps and ONE 🔦 Threat Hunt while the sleeper is ACTIVE. Dormant sleepers cannot be eradicated.
🕵️ Attacking
💵 Initial access income: each successful access foothold grants Red +$500 per Red turn while access remains. Multiple footholds stack; losing access clears the active count.
🚪 Get inside first: internal attacks only work once Red has a foothold (phishing, stolen passwords, external exploits, or bought access). Access stays until Blue kicks Red out with 🔦 Hunt Backdoor, 🚨 Isolate & Contain, 🔄 Reset Passwords or 🧹 EDR Clean-up.
🔑 Passwords: MFA Bombing needs a known password, from phishing, leaks, credential stuffing or brute force. Even a login blocked by MFA teaches the password.
💰 Double Extortion needs stolen data (☁️ Cloud Exfiltration or 🔐 C2 Tunnel) and 💀 Ransomware first.
🕳️ Bypass attacks break certain barriers: Firewall Exploit, EDR Killer, MFA Bombing, Delete Backups, Pivot, Help Desk Trick.
🚪 Inside attacks skip the perimeter and people defenses (firewall, WAF, email filter, training…). Outbound tunnels still pass the firewall.
🛡️ Defending
Defenses come in 8 categories: Network, Web Application, Identity & Access, People, Endpoint, Data, Monitoring, Governance & Risk. Many attacks have more than one counter (defense in depth).
⏳ Setup time: big projects (EDR, training, segmentation, PAM…) take 1–2 turns (🚧) before they block. 💸 Rush them for $2k per turn.
🔧 Upgrades: 🔩 Strict Config (can't be bypassed), 📡 Telemetry (+Trace, −1 damage), 🔬 Deep Inspection (firewall checks outbound traffic), 🔢 Number Matching (stops MFA bombing).
💣 Zero-days have no patch: each defense-in-depth layer cuts 1 damage, and all of them together block it.
👁️ SIEM halves the next attack that gets through. 💾 Backups don't stop ransomware, they help you recover (damage −3).
🚨 Incident Response (Battle Mode) follows the real steps: Detect (🔦 Hunt Backdoor) → Contain (🚨 Isolate & Contain: no re-entry for 2 turns; ⛔ Block IOCs: Red's last attack is banned for 3 turns) → Eradicate (🔄 Reset Passwords & Sessions, 🧹 EDR Clean-up) → Recover (📀 Restore from Backup: +6 Data with a backup, +2 without) → Learn (📝 Lessons Learned: get the defense for the last attack that hit you).
🚨 Alerts: when Red breaks in, a ready 📊 SIEM, 🏢 SOC or 🍯 Honeypot always spots it, and 🤖 EDR or 📡 Telemetry usually does. Blue then gets a response card (Hunt, Isolate or Reset Passwords). No monitoring = the hacker hides inside unnoticed.
⚡ Combos, money & special cards
⚡ Combine the right 2–3 cards into a ⭐ Combo card (Firewall + Patching = 🏰 Hardened Firewall). Combos cover more and can't be bypassed. The game shows when you're 1 card away.
💰 Budget & Shop: Blue gets a budget every turn; Red earns money from hits. Defending costs more than attacking, like real life. Some items have ⏳ cooldowns.
💰 Sell cards for less than they cost. 🃏 Spend 1 ⚡ Power to draw an extra card. 📰/🔍 cards draw 2 and let you play again.
✨ Power: at 6 ⚡, summon a legendary 🏢 24/7 SOC Team or 🐉 Nation-State APT.
🎲 Penalties trigger when drawn: 🧊 Change Freeze (no patching) or 🚨 Exploit Detected.
⭐ Card levels (Battle): play a barrier you already have to level it up. Level 2 gives +1 Trace on every block; Level 3 also can't be bypassed or switched off. Red's attacks get practiced too: an attack that lands hits +1 harder the next time.
🧩 Set bonus (Battle): 3 working barriers from the same category make a set. Every attack that gets through does −1 damage per set (defense in depth).
🌍 World events (Battle) can shake up a round: 🗓️ Patch Tuesday, 🎄 Holiday Weekend (SIEM short-staffed), 📢 Government Security Alert, 📰 Mega Breach, 💵 Board Budget, 🤖 AI App Craze, 🎗️ Awareness Month, 📦 Vendor Breach.
🏷️ Attack cards show their MITRE ATT&CK ID (like T1566 = Phishing), the catalog real security teams use.
🎯 Scenarios, 🏅 Badges & 🎓 Classroom
🎯 Scenarios drop you into a real-life crisis with a goal and a time limit: Friday 5pm Ransomware, Phishing Storm, Leaked Admin Password, Poisoned Update, or play Red in Crack the Fortress.
🏅 Badges are earned for great plays (like a 🧱 Brick Wall win with no Data lost). They're saved in this browser.
🎓 Classroom mode is for a projector: bigger screen, and on each turn the class votes on a card with a countdown. The teacher taps + for each raised hand, and the top card plays when time runs out.
🧱 Stack Mode
Blue gets 12 random defense cards and lines up to 10 barriers. Slot 1 is closest to the hacker.
🔍 Red scans Blue's first 3 barriers, then lines up to 10 attacks in launch order.
🚀 Launch: each attack meets the barriers in order, and every layer explains what it did. The first barrier that can stop it blocks it.
Attacks fizzle if their step isn't ready yet (e.g. ransomware before getting inside). Each block = +1 Trace; at 8 the hacker is caught. The school starts with 12 Data.
💰 Budget Mode
Blue has a $20k security budget, Red has $16k. Every card is in the catalog, grouped by category, with prices based on real-world costs.
Tap a card to buy it; ✖ removes it for a full refund. One of each defense is enough (barriers stay up).
Then it plays out like Stack Mode. The school starts with 14 Data.