Security Games and Exercises

Tabletop exercises and card games have become a powerful way to build security awareness across both cyber and physical domains. By simulating real-world threats in a low-stakes environment, participants can work through attack scenarios, surface blind spots, and start thinking like adversaries — all without the consequences of an actual incident.

Games like Backdoors and Breaches: NGO Edition, Press Panic, and The Mass Cyber Card Deck make this learning tangible and engaging. Rather than sitting through dense compliance training, players are challenged to make real decisions around incident response, threat modeling, and security tradeoffs. The result is stronger team communication, better preparedness, and security concepts that actually stick. This document provides information on some games designed specifically for NGOs.

Backdoors and Breaches: NGO Edition

By Black Hills Information Security and Active Countermeasures, with the specialized NGO-pack designed by NGO-ISAC.

NGO-ISAC edition: https://github.com/ngoisac/play.backdoorsandbreaches.com

Home page: https://home.backdoorsandbreaches.com/

Backdoors & Breaches takes traditional tabletop exercises and turns them into a structured, cooperative card game.

An Incident Captain crafts a scenario using hidden Attack cards, while Defenders work together—using Detections, dice, and critical thinking—to uncover what happened before it’s too late.

The Mass Cyber Card Deck

By MassCyberCenter

https://masscybercenter.org/cybersecuredeck

The CyberSecureDeck, Defend the Network! card game is an engaging way to foster discussions about cybersecurity, identifying threats and addressing vulnerabilities. The game's objectives are to practice cyber incident response, evaluate response and recovery needs and enhance response plans. The goal of the game is for the players to guide the organization through a cybersecurity scenario, focusing on Identifying, Protecting, Detecting, Responding and Recovering from incidents.

Press Panic

by Larus Argentatus:

Access the content: https://codeberg.org/larus-argentatus/press-panic-cards

Print your own deck: https://www.thegamecrafter.com/games/press-panic-orgsec-newsroom

Press Panic is an open source digital security game that is specifically designed to help groups strengthen their organizational security. This card game is particularly helpful in grounding the concept of threat modeling.

Other Games & Resources

CAT & Mouse: Better incident response through simulation

A team of cybersecurity experts and game designers first created this game for the Ford Foundation in 2021-2022. https://catandmousegame.com/

CAT & Mouse is a cybersecurity online training game for small to medium sized teams and organizations, particularly those in the not-for-profit space. Each round of the game simulates a real cyber attack, where players take on the role of either the defenders or attackers.

Tabletop Exercise Scenarios and Facilitation Guide for Digital Safety Training for Journalists

By Internews https://internews.org/resource/tabletop-exercise-scenarios-and-facilitation-guide-for-digital-safety-training-for-journalists/

Tabletop exercises (TTXs) are a valuable scenario-based training tool, which can make digital safety training more engaging and interactive. These resources include a guide on designing and facilitating TTXs as a digital safety training method, as well as a set of digital safety focused TTX scenarios, which may be used by anyone to enhance digital security training. Within these guides, you will find brief explanations of what is a TTX, why TTXs can be valuable supplements to digital safety training, and how one can develop, plan, and facilitate TTXs.

CISA Tabletop Exercise Packages

By CISA https://www.cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages

Tools for stakeholders to conduct planning exercises on a wide range of threat scenarios.