The Malware & Monsters family
Malware & Monsters is an open-source incident-response tabletop and an OWASP project. A handful of games have grown from it: an add-on, two games for new audiences, and one separate cousin. They borrow the Incident Master, the person who runs the table, and change what the table practises.
These are games I have made.
The games
Malware & Monsters
The core game. A collaborative incident-response tabletop. Players take roles in a branching scenario while an Incident Master narrates. Open source, an OWASP project, with its own website.
Presumption Deck
An add-on for Malware & Monsters. A card deck where players call and commit to a read of the incident, then reveal, so the table sees how well calibrated its confidence was.
Malware & Management
A one-hour tabletop for executives. Four seats, CEO, CFO, CIO and CISO, contain a fast-moving malware incident while an Incident Master voices the technical team.
Comrades & Chollimas
A collaborative incident-response tabletop about North Korean IT-worker hiring fraud. One case file, three new hires, three stages and a d20. The question is not who the bad hire is, but what the risk is.
Manipulation & Monsters
A separate product. A tabletop game about catching manipulation, from scams to coercive control, while it is still happening. Tactics appear as creatures with a Tell, a Grip and a Counter. It has its own identity and audience. Links to its public repository.
At a glance
| Malware & Monsters | Core game. Security teams and incident responders. Published, open source. |
|---|---|
| Presumption Deck | Add-on to Malware & Monsters. On this site. |
| Malware & Management | Spin-off for executives. Four to eight seats plus an Incident Master, about one hour. |
| Comrades & Chollimas | Sister game. Two chairs, one case file, three stages. Has its own website. |
| Manipulation & Monsters | Cousin, separate product. Three to six players plus an Incident Master. |
Want to play one with your team?
Tell me about your team and what you want it to practise. A short description is enough; please do not send sensitive data at this stage.
