Game-Based Learning
Game-Based Learning (GBL) works on a simple loop: make the call, see the consequence, then talk through why it went the way it did. That loop is what a real incident forces on you anyway, just without the real damage if you get it wrong. It’s the same reason flight simulators and fire drills work: knowing what to do and having done it under pressure are different skills, and only one of them holds up when the room is tense and the clock is running.
Most security training skips the loop. Slides explain the decision. A checklist tells you the steps. Neither one puts you in the seat where you actually have to decide, watch it play out, and get corrected. That gap, between knowing and doing, is where instinct fails to form.
Every game below is built around that decision, consequence, debrief spine. Some are designed to be played again and again until the instinct sticks. Others are built for one high-stakes session where the point is surfacing a decision, or a disagreement, your team hasn’t had to face out loud yet.
What one turn through the loop does
Can’t see the video ? Try this.
In the video above I reference the following articles and studies:
- Playing to learn: Panelists at Stanford discussion say using games as an educational tool provides opportunities for deeper learning
- How 'Dungeons & Dragons' Primes Students for Interdisciplinary Learning, Including STEM
If you, like me, are really interested in GBL, you'll definitely find this article interesting as well.
Two kinds of game
Repeat-play training games
- Malware & Monsters: a tabletop incident response game where teams work through real malware families as branching scenarios that evolve based on what the players actually do. The same format extends to threat hunting, vulnerability prioritization, supply chain risk, and zero trust decisions, ask about a custom session built around the judgment call your team actually needs to practice.
- Risk Deck: a free, print-and-play card game where technical and business players each commit their read of the same incident privately, reveal at once, and have to explain the other side’s half in plain language. Solo or group. Built for repetition, calibration sharpens the more you play.
Single-session facilitation games
- EXPOSURE: your board runs the company through three rounds of governance decisions, budget, incident escalation, vendor risk, and watches the consequences land on choices they made themselves.
- FAULT LINE: your team builds a physical model of your own architecture, then watches it get stressed by failure events introduced one by one.
- SPREAD: for teams that already know risk management and need to find out, in the room, where their own judgment quietly diverges.
- FAILOVER: your real continuity plan gets put on the table, broken with live injects, escalation failures and comms breakdowns, then a structured debrief turns what went wrong into a concrete list of gaps and amendments.
See the full lineup on the Serious Games page. Not sure which fits? Get in touch and tell me what you want your team to practice.
