A cybersecurity card game. Defend the school's data as the Blue Team, or test its defenses as an ethical hacker on the Red Team.
1 Choose a game mode
⚔️ Blue places barriers on the road; Red sends attacks down it. Survive 10 waves or fill the Trace meter (Blue), or take the Data to 0 (Red).
🧱 Blue lines up barriers (Red can scan the first 3), Red lines up attacks in order, then everything launches. Order matters!
💰 Blue gets a $20k security budget, Red gets $16k. Buy your kit from the full catalog (prices follow real-world costs), line it up, then launch.
2 Who are you playing against?
Opponent
Bot difficulty
3Pick your team
🛡️
Blue Team · Defense
Protect the school with firewalls, MFA, EDR, training, backups and more.
Win: survive, or trace the hacker
🕵️
Red Team · Offense
Play an ethical hacker hired to find the gaps in the school's defenses.
Win: take the Data to 0
🛣️The mapA road runs from the hacker to the school's data.
🛡️BluePlaces barriers that keep blocking matching attacks.
🕵️RedSends attacks down the road, looking for gaps.
💡LearnEvery block and hit explains the real-life security lesson.
📚 Full rules
🎮 Basics
The map shows a road from the hacker 🕵️ to the school's data 🗄️.
🛡️ Blue plays defense cards, which drop barriers on the road (up to 6). A barrier keeps stopping its matching attacks, like real security tools, until a bypass attack breaks it or Blue replaces it.
🕵️ Red plays attack cards. If no matching barrier is in the way, they hit the school's Data.
Each turn: draw a card, then play one (or discard). Blue goes first, then Red: that's one wave.
Blue wins by surviving 10 waves or filling the 🕵️ Trace meter (+3 per block). Red wins by taking the Data to 0.
🐢 Teach Mode pauses after every attack to explain it. Press Next ▶ (or Enter).
🕵️ Attacking
🚪 Get inside first: internal attacks only work once Red has a foothold (phishing, stolen passwords, external exploits, or bought access). Access stays until Blue kicks Red out with 🔦 Hunt Backdoor, 🚨 Isolate & Contain, 🔄 Reset Passwords or 🧹 EDR Clean-up.
🔑 Passwords: MFA Bombing needs a known password, from phishing, leaks, credential stuffing or brute force. Even a login blocked by MFA teaches the password.
💰 Double Extortion needs stolen data (☁️ Cloud Exfiltration or 🔐 C2 Tunnel) and 💀 Ransomware first.
🕳️ Bypass attacks break certain barriers: Firewall Exploit, EDR Killer, MFA Bombing, Delete Backups, Pivot, Help Desk Trick.
🚪 Inside attacks skip the perimeter and people defenses (firewall, WAF, email filter, training…). Outbound tunnels still pass the firewall.
🛡️ Defending
Defenses come in 7 categories: Network, Web Application, Identity & Access, People, Endpoint, Data, Monitoring. Many attacks have more than one counter (defense in depth).
⏳ Setup time: big projects (EDR, training, segmentation, PAM…) take 1–2 turns (🚧) before they block. 💸 Rush them for $2k per turn.
🔧 Upgrades: 🔩 Strict Config (can't be bypassed), 📡 Telemetry (+Trace, −1 damage), 🔬 Deep Inspection (firewall checks outbound traffic), 🔢 Number Matching (stops MFA bombing).
💣 Zero-days have no patch: each defense-in-depth layer cuts 1 damage, and all of them together block it.
👁️ SIEM halves the next attack that gets through. 💾 Backups don't stop ransomware, they help you recover (damage −3).
🚨 Incident Response (Battle Mode) follows the real steps: Detect (🔦 Hunt Backdoor) → Contain (🚨 Isolate & Contain: no re-entry for 2 turns; ⛔ Block IOCs: Red's last attack is banned for 3 turns) → Eradicate (🔄 Reset Passwords & Sessions, 🧹 EDR Clean-up) → Recover (📀 Restore from Backup: +6 Data with a backup, +2 without) → Learn (📝 Lessons Learned: get the defense for the last attack that hit you).
⚡ Combos, money & special cards
⚡ Combine the right 2–3 cards into a ⭐ Combo card (Firewall + Patching = 🏰 Hardened Firewall). Combos cover more and can't be bypassed. The game shows when you're 1 card away.
💰 Budget & Shop: Blue gets a budget every turn; Red earns money from hits. Defending costs more than attacking, like real life. Some items have ⏳ cooldowns.
💰 Sell cards for less than they cost. 🃏 Spend 1 ⚡ Power to draw an extra card. 📰/🔍 cards draw 2 and let you play again.
✨ Power: at 6 ⚡, summon a legendary 🏢 24/7 SOC Team or 🐉 Nation-State APT.
🎲 Penalties trigger when drawn: 🧊 Change Freeze (no patching) or 🚨 Exploit Detected.
🧱 Stack Mode
Blue gets 12 random defense cards and lines up to 10 barriers. Slot 1 is closest to the hacker.
🔍 Red scans Blue's first 3 barriers, then lines up to 10 attacks in launch order.
🚀 Launch: each attack meets the barriers in order, and every layer explains what it did. The first barrier that can stop it blocks it.
Attacks fizzle if their step isn't ready yet (e.g. ransomware before getting inside). Each block = +1 Trace; at 8 the hacker is caught. The school starts with 11 Data.
💰 Budget Mode
Blue has a $20k security budget, Red has $16k. Every card is in the catalog, grouped by category, with prices based on real-world costs.
Tap a card to buy it; ✖ removes it for a full refund. One of each defense is enough (barriers stay up).
Then it plays out like Stack Mode. The school starts with 13 Data.