A cybersecurity card game. Defend the school's data as the Blue Team, or test its defenses as an ethical hacker on the Red Team.
1 Choose a game mode
⚔️ Blue places barriers on the road; Red sends attacks down it. Survive 10 waves or fill the Trace meter (Blue), or take the Data to 0 (Red).
🔁 Battle rounds (10 waves each)
Cards, defenses, upgrades, money and persistence carry over; Data and Trace reset each round. Win the most rounds to win the match. Up to 40 waves.
🙈 Hidden defenses
🧱 Blue lines up barriers (Red can scan the first 3), Red lines up attacks in order, then everything launches. Order matters!
💰 Blue gets a $23k security budget, Red gets $16k. Buy your kit from the full catalog (prices follow real-world costs), line it up, then launch.
2 Who are you playing against?
Opponent
Bot difficulty
3Pick your team
🛡️
Blue Team · Defense
Protect the school with firewalls, MFA, EDR, training, backups and more.
Win: survive, or trace the hacker
🕵️
Red Team · Offense
Play an ethical hacker hired to find the gaps in the school's defenses.
Win: take the Data to 0
🛣️The mapA road runs from the hacker to the school's data.
🛡️BluePlaces barriers that keep blocking matching attacks.
🕵️RedSends attacks down the road, looking for gaps.
💡LearnEvery block and hit explains the real-life security lesson.
📚 Full rules
🎮 Basics
The map shows a road from the hacker 🕵️ to the school's data 🗄️.
🛡️ Blue plays defense cards, which drop barriers on the road (up to 6).
🌫️ Hidden defenses (Battle, can be switched off in setup): Red can always see internet-facing 🧱 Perimeter barriers, but everything deeper shows as ❓ until it blocks, spots or softens an attack. Red can play 🔎 Internal Recon (Network Scan) or the all-in-one 🦉 Situational Awareness (+2 Trace) from inside to reveal them (🧩 Segmentation limits it, a 👁️ SIEM spots it, and a hardened 🤖 EDR blocks it), or 🔍 External Recon to learn one from outside. Real attackers can't see inside the network either.
A barrier keeps stopping its matching attacks, like real security tools, until a bypass attack breaks it or Blue replaces it.
🕵️ Red plays attack cards. If no matching barrier is in the way, they hit the school's Data.
Each turn: draw a card, then play one (or discard). Blue goes first, then Red: that's one wave. When Red has no active foothold at the start of a new wave, Blue earns an extra $500. Red earns $500 per active foothold per Red turn.
Red can purchase Initial Access from the Dark Web Market at most three times per game session, including across Battle rounds. Other earned footholds are not purchases.
👑 Admin rights: how Red gets in decides whether it lands as an admin. Leaked admin credentials, a stolen SSO session and SYSTEM-level entries (zero-click, poisoned updates, APT) land as admin. Most others land as a normal user, although some victims turn out to have local admin rights (🎫 Least Privilege prevents that). Red doesn't know which until 🦉 Situational Awareness checks or 👑 Escalate to Administrator lands. EDR Killer, Delete Backups, Hash Exfiltration, Sleeper Persistence and Blind & Encrypt need admin; trying them as a user fails (+1 Trace).
🔐 Credential & Hash Exfiltration requires initial access; it simulates stealing credentials, offline hash cracking and creating an internal backdoor account. This adds one foothold until Blue eradicates access.
Blue wins by surviving 10 waves or filling the 🕵️ Trace meter (+3 per block). Red wins by taking the Data to 0.
🔁 Rounds: in a multi-round match, Data refills and Trace resets at the start of every round; everything else carries over. Whoever wins more rounds wins the match (an even split is a draw).
🐢 Teach Mode pauses after every attack to explain it. Press Next ▶ (or Enter).
🛌 Sleeper Persistence
Red installs a dormant sleeper only while inside. Once installed it survives losing access.
Buy a 📱 Dead-Drop ($1k, +1), 🌐 New Domain ($2k, +2), or 📡 Special Packet ($3k, +3) trigger in the Dark Web Market. It attaches to the sleeper, not your hand. Reactivating from the shop uses up the trigger (buy another to wake it again), and it doesn't work while Blue's 🚨 Isolate & Contain is active.
Firewall with 🔬 Deep Inspection, DNS filtering, or 🏰 Hardened Firewall detects the new-domain trigger.
Blue needs TWO 🧹 Security Sweeps and ONE 🔦 Hunt Backdoor, each played while the sleeper is ACTIVE, in any order. Progress is kept if the sleeper goes dormant in between. Dormant sleepers can't be swept or hunted.
🕵️ Attacking
💵 Initial access income: each successful access foothold grants Red +$500 per Red turn while access remains. Multiple footholds stack; losing access clears the active count.
🚪 Get inside first: internal attacks only work once Red has a foothold (phishing, stolen passwords, external exploits, or bought access). Access stays until Blue kicks Red out with 🔦 Hunt Backdoor, 🚨 Isolate & Contain, 🔄 Reset Passwords or 🧹 EDR Clean-up.
⚡ Privileged Access Combo (Battle): Successfully steal a 🎫 SSO session and reach 👑 Domain Admin. On Red's turn, click Unlock combo card to receive ⚠️ GPO-Wide Defense Impairment directly, without randomly drawing it. Play the resulting card normally. Each stolen SSO session unlocks the combo once; revocation cancels eligibility.
🔑 Passwords: MFA Bombing needs a known password, from phishing, leaks, credential stuffing or brute force. Even a login blocked by MFA teaches the password.
💰 Double Extortion needs stolen data (☁️ Cloud Exfiltration or 🔐 C2 Tunnel) and 💀 Ransomware first.
🕳️ Bypass attacks break certain barriers: Firewall Exploit, EDR Killer, MFA Bombing, Delete Backups, Pivot, Help Desk Trick.
🚪 Inside attacks skip the perimeter and people defenses (firewall, WAF, email filter, training…). Outbound tunnels still pass the firewall.
🛡️ Defending
Defenses come in 8 categories: Network, Web Application, Identity & Access, People, Endpoint, Data, Monitoring, Governance & Risk. Many attacks have more than one counter (defense in depth).
⏳ Setup time: big projects (EDR, training, segmentation, PAM…) take 1–2 turns (🚧) before they block. 💸 Rush them for $2k per turn.
🔧 Upgrades: 🔩 Strict Config (can't be bypassed), 📡 Telemetry (+Trace, −1 damage), 🔬 Deep Inspection (firewall checks outbound traffic), 🔢 Number Matching (stops MFA bombing), 🩹 Virtual Patching, 🏷️ External Banner, 🎣 Phishing Simulations, 🔁 Automated Patching (extra zero-day layer, shorter freezes), 🧪 Tested Restores (+8 Data restores), 🔏 Immutable Storage (backups can't be deleted), 🤖 SOAR (SIEM halves one more attack), ⏱️ Just-in-Time Access (PAM stops lateral movement), 🔬 Microsegmentation (no pivot bypass), 🧬 Fingerprint DLP (stops C2 tunnels) and 🐤 Canary Tokens (+2 Trace when Red gets inside).
💣 Zero-days have no patch: each defense-in-depth layer cuts 1 damage, and all of them together block it. A 👁️ SIEM halves what gets through.
👁️ SIEM halves the next attack that gets through. 💾 Backups don't stop ransomware, they help you recover (damage −3).
🚨 Incident Response (Battle Mode) follows the real steps: Detect (🔦 Hunt Backdoor) → Contain (🚨 Isolate & Contain: no re-entry for 2 turns; ⛔ Block IOCs: Red's last attack is banned for 3 turns) → Eradicate (🔄 Reset Passwords & Sessions, 🧹 EDR Clean-up) → Recover (📀 Restore from Backup: +6 Data with a backup, +2 without) → Learn (📝 Lessons Learned: get the defense for the last attack that hit you).
🚨 Alerts: when Red breaks in, a ready 📊 SIEM, 🏢 SOC or 🍯 Honeypot always spots it, and 🤖 EDR or 📡 Telemetry usually does. Blue then gets a response card (Hunt, Isolate or Reset Passwords). No monitoring = the hacker hides inside unnoticed.
⚡ Combos, money & special cards
⚡ Combine the right 2–3 cards into a ⭐ Combo card (Firewall + Patching = 🏰 Hardened Firewall). Red has combos too: 🎣 Account Takeover, ⛓️ Kill Chain, 🫥 Blend-In, 🙈 Blind & Encrypt (EDR Killer + Ransomware), 🌪️ Push Storm (Credential Stuffing + MFA Fatigue) and 🐴 Trojanized Update (Supply Chain + Deploy Tools). Combos cover more and can't be bypassed. The game shows when you're 1 card away.
💰 Budget & Shop: Blue gets a budget every turn; Red earns money from hits. Defending costs more than attacking, like real life. Some items have ⏳ cooldowns.
💰 Sell cards for less than they cost. 🃏 Spend 1 ⚡ Power to draw an extra card. 📰/🔍 cards draw 2 and let you play again.
✨ Power: at 6 ⚡, summon a legendary 🏢 24/7 SOC Team or 🐉 Nation-State APT.
🎲 Penalties trigger when drawn. Blue's: 🧊 Change Freeze (no patching) and 📉 Company Downsizing (−$3k, −2 ⚡, and two defenses take +1 turn to set up: ones already being built first, then the next ones placed). Red's: 🚨 Exploit Detected and 🚀 Accelerated Deployment (Blue's setups finish in half the time, and new ones are half-time for 3 turns).
🎭 Red tricks (Battle) are free actions that change the next attack: 🎭 Obfuscation (dodges a plain EDR), 🐌 Low-and-Slow (ignores SIEM and Telemetry), 🧬 Polymorphic Payload (clears blocked IOCs; a block gives only +1 Trace).
⭐ Card levels (Battle): play a barrier you already have to level it up. Level 2 gives +1 Trace on every block; Level 3 also can't be bypassed or switched off. Red's attacks get practiced too: an attack that lands hits +1 harder the next time.
🧩 Set bonus (Battle): 3 working barriers from the same category make a set. Every attack that gets through does −1 damage per set (defense in depth).
🌍 World events (Battle) can shake up a round: 🗓️ Patch Tuesday, 🎄 Holiday Weekend (SIEM short-staffed), 📢 Government Security Alert, 📰 Mega Breach, 💵 Board Budget, 🤖 AI App Craze, 🎗️ Awareness Month, 📦 Vendor Breach.
🏷️ Attack cards show their MITRE ATT&CK ID (like T1566 = Phishing), the catalog real security teams use.
🎯 Scenarios, 🏅 Badges & 🎓 Classroom
🎯 Scenarios drop you into a real-life crisis with a goal and a time limit: Friday 5pm Ransomware, Phishing Storm, Leaked Admin Password, Poisoned Update, or play Red in Crack the Fortress.
🏅 Badges are earned for great plays (like a 🧱 Brick Wall win with no Data lost). They're saved in this browser.
🎓 Classroom mode is for a projector: bigger screen, and on each turn the class votes on a card with a countdown. The teacher taps + for each raised hand, and the top card plays when time runs out.
🧱 Stack Mode
Blue gets 12 random defense cards and lines up to 10 barriers. Slot 1 is closest to the hacker.
🔍 Red scans Blue's first 3 barriers, then lines up to 10 attacks in launch order.
🚀 Launch: each attack meets the barriers in order, and every layer explains what it did. The first barrier that can stop it blocks it.
Attacks fizzle if their step isn't ready yet (e.g. ransomware before getting inside). Each block = +1 Trace; at 8 the hacker is caught. The school starts with 13 Data.
💰 Budget Mode
Blue has a $23k security budget, Red has $16k. Every card is in the catalog, grouped by category, with prices based on real-world costs.
Tap a card to buy it; ✖ removes it for a full refund. One of each defense is enough (barriers stay up).
Then it plays out like Stack Mode. The school starts with 14 Data.