Cybersecurity · Two-sided defend-and-test tabletop

🛡️ How to play Breach Point

Defend Wadi Freight with a limited security budget, or test it as an authorised red team that must stay within the rules.

Join a game Run it as facilitator Print this guide

Your goal

Blue teams win by keeping threats from reaching valuable assets with layered controls that staff can live with. Red teams win by finding where a client is weakest, within the agreed scope. Every score comes from an attack-graph model: get in, move inside, stay unseen.

Teams alternate by join order: the first is a blue (defending) team, the second a red (testing) team, and so on. Each round every red team is paired with a different blue team; anyone without a partner faces a simulated one.

Join in 30 seconds

Scan the QR code on the big screen with your phone camera, or open the game page and type the 4-letter code.
Type your first name. No app, no account.
Join a team or create one and name it. Your teammates get a role each. In individual mode you run your own security team.
If your phone locks or the page reloads, open it again: you return to the same seat.

Team roles

Lead: Chairs the team and submits the final decision. If the Lead's phone dies, any teammate can take over. In this game: Blue: agree the budget split. Red: agree the scenario and confirm it stays in scope.
Analyst: Owns the numbers and the team's prediction for the round. In this game: Read the threat intelligence and estimate which entry point is most likely to succeed.
Treasurer: Watches the budget and costs before the team commits. In this game: Blue: no control should be zero. Red: check the recon bands before spending effort.
Risk and ethics officer: Flags harms and pushes back before the team commits. In this game: Blue: watch staff friction and privacy. Red: stop any plan that breaks the rules of engagement.
Voice: Talks to other teams and presents the team's story at the debrief. In this game: Explain your choices at the debrief: what did the other side teach you?

The three rounds

Each round you predict your own result, make your decisions within about 8 minutes, and then the model reveals what happened. An event card lands between rounds.

1
Round 1 · Small business
Blue teams have 12 tokens on top of a weak starting setup. Red teams pick one entry point and one target for their paired client.
Watch for: Teams that pour everything into one control and leave others at zero.
2
Round 2 · Cloud and remote work
Password and supplier entry points become 25% more likely. Budget 14. Pairings rotate, and the sector report shows last round's most common scenario.
Watch for: Whether blue teams react to the threat intelligence or repeat Round 1.
3
Round 3 · Ransomware scenario
Damage is 50% higher because data is locked, and recovery depends on offline backups and the response plan. Budget 16.
Watch for: Teams that skipped backups until now.

Your decisions

What each control on your phone does, and how to think about it.

Security budget	Blue · every round	Spread 12, 14 and then 16 tokens across the six controls (up to 8 on one). Each token raises a level; strength = 1 − e^(−level/5), so the first tokens in a control count most. Never leave a control near zero: threats go to the weakest layer.
Incident response plan	Blue · every round	Isolate fast cuts off affected systems at once: 2 points of downtime but less recovery damage in the ransomware round. Watch, then act keeps systems running but recovers more slowly. Isolating fast matters most in Round 3.
Threat scenario (entry point)	Red · every round	Deceptive email to staff, reused or weak password, out-of-date public server, careless insider, or supplier with remote access. Each is blocked by different controls. Read the recon bands: pick the entry point whose blocking controls look low.
Target asset	Red · every round	Customer database (40), payment system (30), file server (20) or email system (10). Email is reachable directly; the others need a move inside the network, which segmentation slows. A valuable target behind strong segmentation can be worth less than email.
Test approach	Red · every round	Slow and quiet cuts the chance of detection by 40% but reaches 20% less. Fast and loud reaches more but is easier to spot. Go quiet against strong monitoring.
Rules of engagement	Red · every round	Stay in the agreed scope (+4 trust) or go beyond it into staff's personal accounts: +6 points but −20 trust. Real testers who break scope lose the contract. The score reflects that.

What you see on your phone

Your controls (blue): Six controls with their current level and strength: patching, multi-factor login, segmentation, offline backups, staff training and monitoring. Levels carry over, but 20% fades each round.
Threat intelligence (blue): Sector reports from earlier rounds: the test scenario most red teams used last time. Use it to guess where the next test will come from.
Recon (red): Your client's name and its visible defences as low, medium or high bands, plus the base likelihood of each entry point this round.
Results: The chance to get in, to reach the target and to stay unseen, the overall reach, and what it cost or earned you.

How you are scored

Every game in the library uses the same scoreboard. Your round result is your Security score (pts); the leaderboard adds resilience and trust.

Score = 100 × (0.5 × performance + 0.25 × resilience + 0.25 × trust) + prediction points

Performance: Security scoreSecurity score out of 100. Blue: 100 − 13 × expected loss (impact on the asset plus recovery and downtime), averaged over the tests faced. Red: 15.6 × the loss caused, +6 if out of scope, capped at 100.

Resilience (0–100)Blue: moves halfway each round toward the average strength of all six controls, cut by 20% if any control is below level 2. Red: moves halfway toward the chance of staying unseen.

Trust (0–100)Blue: +3 a round plus up to +4 for training; minus friction for very heavy MFA (above 6) or monitoring (above 7); after the 72-hour rule, undetected reach also costs trust. Red: +4 for staying in scope, −20 for breaking it.

Performance is your total Security score over the rounds, scaled from the lowest to the highest in the room. Before each round you also predict “Your score this round (0–100)”: land close and earn up to 10 bonus points; miss by the whole amount and earn none. The facilitator may change the weights before the game starts.

Tips

Blue: layers beat a single wall. Three medium controls on a path usually stop more than one very strong one.
Blue: read the sector report. Red teams copy what worked last round.
Blue: buy backups before Round 3; they are the only control that reduces ransomware damage after a breach.
Red: the recon bands are rough on purpose. Look for the entry point whose blocking controls are all low.
Red: email is easy to reach but worth little. Weigh value against the extra layer inside the network.

Common mistakes

Spending the whole budget on monitoring until staff complain and trust falls.
Forgetting that 20% of every level fades each round, so controls need topping up.
Red teams going beyond scope for a few points and losing 20 trust.
Ignoring segmentation, so one way in leads to every asset.

A worked example

In Round 2 a red team sees low bands for MFA and monitoring at Pearl Watch, so it picks reused passwords against the customer database, slow and quiet. The chance to get in is 40%, to move inside 55%, to stay unseen 85%: reach 15%. Pearl Watch loses about 6 points of value and scores 22; the red team scores 94. In Round 3 Pearl Watch spends on MFA and backups, and the next test reaches only 3%.

Shocks that can hit

The facilitator draws one event card before rounds 2 and 3. It changes the market from that round on.

A zero-day weakness is announced. A flaw with no patch yet affects common server software. Patching protects only half as well next round.
Phishing season. Fake shipping notices flood inboxes before the holidays. Deceptive emails are 50% more likely to get in.
A staff laptop is lost. A manager leaves a laptop in a taxi with saved passwords. Password entry points are 40% more likely.
A supplier is breached. A software supplier used by many firms reports an incident. Supplier access is 60% more likely to be abused.
72-hour breach-notice rule. A new rule requires firms to report breaches within 72 hours. Undetected damage now also costs blue teams trust.

The model behind the game

Attack graph with control strengths and detection. Each threat must pass several layers: get in, move to the target, and stay unseen. Every control weakens one or more layers, so a few strong layers beat one perfect wall.

reach = P(entry) × P(move inside) × (1 − P(detect)) ; P(entry) = base × (1 − blocking by controls) ; strength = 1 − e^(−level/5)

Attack surface: All the ways a threat could get into a system: people, passwords, servers and suppliers.
Defence in depth: Several independent layers of protection, so one failure does not lose everything.
Segmentation: Dividing a network into zones so an intruder in one cannot easily reach the others.
Multi-factor login (MFA): Logging in needs a second proof, such as a phone code, as well as the password.
Red team: Authorised testers who act like an adversary to find weaknesses before real attackers do.
Rules of engagement: The written scope and limits a red team agrees with its client before testing.
Ransomware: Malicious software that locks data and demands payment; offline backups let a firm recover without paying.

For facilitators 3 rounds · about 50 minutes

Set-up

Use team mode with at least four teams so there are two blue and two red teams; bots fill any gaps.
Tell the class this is a tabletop exercise: decisions only, no techniques or tools.
Show the six controls and four assets on the projector before Round 1.
Keep the 72-hour notice card for Round 3 if you want to discuss regulation.

Modes

Team: Teams alternate blue and red by join order. Blue teams debate the budget; red teams debate the scenario and the scope.
Individual: Each student is a blue or red team of one. Pairings rotate each round so every red player tests a different client.
Hybrid: Students decide alone but are averaged in teams. Mixed red and blue teams make a good debrief on both sides of the table.

Run sheet

Before class	Open the facilitator console on the projector laptop, choose the mode in Setup, and check the QR shows.
0–5 min	Students scan and join. Read the situation aloud while teams form. Point out the roles on their phones.
5–15 min	Round 1: 8 minutes to decide and predict, then Reveal. Read the headline and one surprising line from a team.
Between rounds	Draw or choose the event card. Give teams 30 seconds to read it before opening the next round.
15–25 min	Round 2, then Reveal.
27–37 min	Round 3, then Final results: podium, awards and the score chart.
Last 12 min	Debrief with the questions below, then open reflections (4 minutes). Download the CSV.

What usually happens

Blue teams that copy the strongest control and ignore the weakest one.
Red teams that always pick the most valuable asset regardless of segmentation.
The moment a team breaks scope: ask why the points did not feel worth it.
Round 3: teams without backups and their reaction to the recovery cost.

Debrief questions

Which single control did the most for your company, and why that one?
Red teams: which recon clue told you where the company was weakest?
Where did security start to hurt staff or privacy, and how would you balance it in a real company?

Follow-up probes

Which control would you buy first with a tiny budget, and why?
Where did security start to annoy staff, and what is the real cost of that?
What did the red team's recon tell them that you could have hidden?
Why do real organisations hire red teams at all?
How does the 72-hour rule change what monitoring is worth?

Reflection and evidence

In 80–120 words: explain defence in depth using one moment from the game, and say what you would protect first in a real organisation with a small budget.

Students write 80–120 words on their phones. The Data tab exports every decision, result, prediction and reflection as one CSV for grading.

Console controls

Pause, extend or set the timer; step back a round
Draw, choose or write the event card
Move players, make a Lead, add computer players
Award or fine with a reason that appears on phones
Message every screen; hide names; spotlight a team
Keys: P projector mode, Q join QR