The Presumption Deck
Real IR isn’t about being right. It’s about how sure you are.
Optional add-on to Malware & Monsters · Facilitated session · Deck free to print
THE MECHANIC
What The Presumption Deck actually is
It’s a call, commit, reveal mechanic layered on top of an incident response exercise. Four card types: Type ID, Confidence (Confident, Probable, or Uncertain), Severity, and Resource. Players call their read of the situation across three gates, Identification, Containment, Response, committing a card face-down before anyone sees what actually happened.
Confidence is called once, at the Identification gate, not at every decision point. That’s deliberate. The point isn’t to grade every call your team makes, it’s to catch the specific moment where a team commits to a read of the situation, then find out afterward whether their confidence matched reality.
Cards flip together, so the team sees not just who was right, but who was confidently wrong, and who correctly said “uncertain” when the room wanted a confident answer.
Type ID (9 cards)
what kind of threat this is
Confidence (3 cards)
how sure you are of that call, called once at Identification
Severity (6 cards)
how bad the room thinks it actually is
Resource (7 cards)
what it will cost the team to respond
HOW A ROUND FEELS
Call, commit, reveal
1. Call
The facilitator names the question and starts a short clock. Discussion stays open right up to the moment of commitment.
2. Commit
Everyone places a card face down at the same time. No changing it once it’s down.
3. Reveal
All cards flip together. The spread gets read aloud, split and all.
Committing before anyone can see the others is the whole trick. A session hangs three gates on the scenario, one at each natural commitment point:
| Gate | When | The team commits to |
|---|---|---|
| Identification | Once the team has its first solid indicators | Type ID + Confidence |
| Containment | When the team must decide how to contain, before the threat escalates | Severity |
| Response | When the team commits its main response, before the window closes | Resource |
Runs on top of any Malware & Monsters scenario.
WHY IT EXISTS
Wrong isn’t the failure mode. Confidently wrong is.
Every estimate a team makes has two independent dimensions: how confident they said they were, and whether they turned out to be right. Cross them and you get four outcomes, and they are not equally good or equally bad.
| Outcome: Right | Outcome: Wrong | |
|---|---|---|
| Said: Confident | Calibrated. Earned confidence, the evidence backed it up | The Trap. Confident and wrong, the dangerous quadrant |
| Said: Uncertain | Under-called. Right, but hedged more than the evidence needed | Honest. Wrong, but the doubt was flagged so the team stayed open |
Uncertain-and-wrong beats confident-and-wrong, every time. A team that says “we’re sure it’s ransomware” and is wrong commits in the wrong direction and stops investigating. A team that says “we think it’s ransomware, but we’re not sure” and is wrong keeps the second hypothesis on the table and recovers faster. The Trap is the quadrant worth building a session around.
Most IR training grades outcomes: did the team contain the threat, yes or no. That misses the more common, more expensive failure: a team that was certain and wrong, or a team that quietly knew it was guessing and said nothing. Both look identical from the outside until something breaks.
The Presumption Deck makes the confidence call visible and comparable, in the room, so the gap between “we said we were sure” and “we were actually right” becomes something the team can see and talk about, not something that only shows up months later in a postmortem.
HOW IT FITS
An add-on, not a replacement
The Presumption Deck is optional. It’s not a substitute for Malware & Monsters, it’s a targeted layer on top of it for teams who’ve already run the core exercise and want to work specifically on calibration and teamwork under uncertainty, not on incident mechanics they’ve already covered.
One session buys your team the vocabulary and the experience of seeing the gap. It doesn’t buy calibration itself, that comes from doing it more than once, the same way the core game does.
FAQ
Frequently asked questions
What is the Presumption Deck?
Who is it for?
Is it standalone?
How do we get the deck?
What's the paid part?
How long is a session?
AVAILABILITY
The deck itself stays free
The cards, the facilitator guide, and the print sheets are all free and open on malwareandmonsters.com, regardless of whether you book a facilitated session. What’s sold is the facilitated session, the deck as an artifact isn’t gated behind it.
Runs alongside Malware & Monsters, or explore the full serious games lineup.
