The first attack chain represents deceptive messages and fake sign-in pages used to steal credentials. Check the sender, domain, request and destination before acting.
BREACH
FLEET
CYBER COMMAND // KNOWLEDGE ARMS THE STRIKE
CYBER COMMAND NETWORK // SONAR LINK
Why questions control the battle.
Cyber defence depends on recognising risk before taking action. Breach Fleet makes that decision visible: sound judgement gives you a precise strike, while unsafe judgement gives the simulated adversary time to counterattack.
The malware chain represents malicious code gaining a foothold, spreading and damaging systems. Patching, endpoint controls, segmentation and tested backups reduce its impact.
The final chain represents stolen data leaving quietly. Monitor unusual access, large transfers, cloud sharing changes and compromised identities.
INCIDENT RESPONSE CYCLEPrepare. Detect.
Prepare. Detect.
Contain. Recover.
- 01PrepareBuild secure systems, train people, protect backups and rehearse response.
- 02DetectUse identity, endpoint, network and cloud evidence to recognise suspicious behaviour.
- 03ContainIsolate affected devices, revoke access and limit the attacker’s movement.
- 04RecoverRemove persistence, restore trusted services and improve the failed controls.
How a cyber attack moves through an organisation.
A real cyber incident rarely consists of one isolated event. An attacker may begin with a phishing email, stolen password or exposed service. That first foothold is valuable because it creates a trusted-looking identity or device from which the attacker can gather information, increase privileges and move towards sensitive systems.
The hidden fleet is an arcade representation of that connected behaviour. The Phishing Skiff is initial access. The Malware Cruiser represents execution, persistence and lateral movement. The Exfiltration Sub represents the quieter final objective: locating valuable information and moving it outside the organisation without being stopped.
Security teams reduce this risk through overlapping controls. Email filtering and awareness reduce successful phishing. MFA and passkeys protect identities. Endpoint detection looks for malicious activity. Network segmentation limits movement. Data monitoring, cloud audit logs and incident-response procedures help defenders detect, contain and recover.
Six ideas behind the battle.
Repeated unexpected approval prompts intended to pressure a user into accepting an attacker’s login.
Giving each identity only the access required for its current job, reducing the effect of compromise.
Dividing systems into controlled zones so an intruder cannot freely move across the whole network.
A protected backup that cannot be changed or deleted during its retention period, supporting ransomware recovery.
Stealing an authenticated browser token so an attacker may act after the legitimate user completed MFA.
Limiting an active incident by isolating devices, blocking access and revoking sessions or credentials.
Cyber command questions
How does Breach Fleet teach cybersecurity?+
Each correct answer arms a coordinate strike and immediately explains the reasoning. Wrong answers trigger a simulated counterattack, hull impact and firewall damage, connecting security judgement with a visible consequence.
What are the hidden ships in Breach Fleet?+
The hidden fleet represents three connected attack patterns: a phishing entry point, a malware operation and an exfiltration chain. Sinking every segment represents detecting and containing the full attack path.
What cybersecurity topics appear in the game?+
Questions cover phishing, MFA fatigue, passkeys, leaked API keys, least privilege, cloud logging, vulnerability management, ransomware-resistant backups, network segmentation, session theft and incident containment.
What is an attack chain in cybersecurity?+
An attack chain is the connected sequence an intruder follows, such as gaining access through phishing, running malicious code, increasing privileges, moving through a network and stealing data.
Why does a wrong answer damage firewall integrity?+
It is an arcade metaphor for the cost of an unsafe decision. In real security work, one weak decision does not literally damage a firewall, but it may give an attacker more time, access or opportunity.
Is cybersecurity only about answering questions?+
No. Real security also requires secure design, technical controls, monitoring, testing, skilled people and incident response. The game is a short practice tool for recognising defensive choices.