Inspect the signal
Start with the target and method. A credential attack needs a different answer from ransomware or data exfiltration.
PROTOCOL 010 // ARCHITECTURE LIVE
BUILD. DEFEND. SURVIVE.
A MODERN CYBER DEFENCE STRATEGY GAME06BREACH WAVES16BUILD POINTS04CRITICAL ZONES
LIVE ARCHITECTURESIMULATION READY
BUILD POINTS 16SCORE 0
DEFENCE ARCHITECT REQUIREDBUILD BEFORE
BUILD BEFORE
THE BREACH.
You have 16 build points and six incoming attacks. Read each signal, select one control and watch the breach hit your architecture.
- 01 Match the control to the attack method.
- 02 Protect the zone being targeted.
- 03 Layer controls - one safeguard is never the whole defence.
READ THE ATTACK.
BUILD THE ANSWER.
Breach Builder turns defence in depth into a visible system. Every decision changes the controls installed around your network, the power available against the next threat and the amount of budget left for later waves.
Select one control
Each round offers three real safeguards. Match the control’s coverage to the incoming attack instead of choosing only its highest power.
Protect the budget
You cannot buy every expensive defence. Balance prevention, detection, containment and recovery across all six waves.
Read the impact
The simulation shows attack power blocked and integrity lost, then explains how that control works in a real organisation.
ONE CONTROL
IS NOT A STRATEGY.
A strong cyber security architecture combines people, processes and technology. These layers reduce the chance of compromise, make suspicious behaviour visible, limit the attacker’s movement and preserve a route to recovery.
Filter and patch exposed services
Internet-facing systems receive constant scanning. Firewalls reduce unwanted traffic, but supported software and prompt security updates remove the exploitable weakness itself. Neither control replaces the other.
REAL EXAMPLE // A web application firewall blocks a known attack pattern while engineers update the affected web framework.Verify strongly, then limit access
Phishing-resistant MFA protects the sign-in. Least privilege controls what happens after sign-in. Session monitoring can still identify a stolen token, impossible travel or a device that no longer matches normal behaviour.
REAL EXAMPLE // A passkey confirms the genuine website, while a finance employee receives finance access - not global administration.Detect execution and stop movement
Endpoint detection watches devices for malicious behaviour. Hardening removes unsafe defaults. Segmentation limits communication so one infected laptop cannot freely reach servers, backups and every other device.
REAL EXAMPLE // An EDR agent isolates a laptop after mass file changes, while network rules prevent it reaching the database zone.Watch the vault and protect recovery
Data loss prevention identifies sensitive information moving to risky places. Central logs help investigators connect events. Immutable backups preserve a recovery path when destructive attacks bypass preventive controls.
REAL EXAMPLE // A large customer export triggers an alert, and protected backup versions cannot be deleted by the compromised account.TWELVE WAYS TO
REDUCE THE BLAST RADIUS.
WHAT DOES THIS GAME TEACH?
What is defence in depth?
Defence in depth is a security approach that uses multiple independent and complementary controls. If phishing defeats one layer, strong authentication, limited access, endpoint detection, segmentation and monitoring can still prevent or contain the attack.
How do you choose the right security control?
Start with the risk: the asset, threat method, likelihood and possible impact. Choose a control that meaningfully reduces that risk, verify it works, monitor it and keep a recovery option for failures.
Why does Breach Builder use a limited budget?
Real organisations have limited time, people and money. Security leaders prioritise controls according to risk, regulatory needs, existing weaknesses and how well safeguards combine - not by purchasing every available product.
BREACH BUILDER FAQ.
What is Breach Builder?+
Breach Builder is a free browser-based cyber defence strategy game. Players spend a limited security budget on practical controls, then test that architecture against six simulated attacks.
What is defence in depth?+
Defence in depth means using several complementary safeguards so one failure does not expose everything. Identity, endpoint, network, data-protection, monitoring and recovery controls work together.
Which security controls help stop phishing?+
Email filtering reduces delivery, user verification reduces unsafe action, and phishing-resistant MFA such as passkeys or security keys prevents a captured password from becoming a successful sign-in.
Why are network segmentation and least privilege important?+
Both limit blast radius. Segmentation controls which systems can communicate, while least privilege restricts what an identity can access. They reduce lateral movement after initial compromise.
What makes a backup resilient to ransomware?+
A resilient backup is isolated or immutable, protected by separate access, monitored, retained for an appropriate period and regularly tested through restoration exercises.
Can organisations use Breach Builder for security awareness?+
Yes. It works as a short discussion starter for employees, students and cyber career beginners, but it does not replace risk assessment, professional architecture or formal training.