introducing The CISO Game

There is no flight simulator for the CISO's chair. So I made one.

The CISO Game is free, takes about 40 minutes, and gives you three years in the hot seat.

Pilots don't meet their first crisis in the air. They meet it in a simulator, again and again, until the right response is a habit rather than a guess.

Cyber security leaders and Chief Information Security Officers have no such luxury. Most of us met our first serious incident live: a board watching, a budget already spent, and advice arriving from every direction at once. You learn a great deal very quickly. You also learn it at the company's expense.

That gap has bothered me for a long time, and not only for CISOs. Boards are asked to oversee cyber risk without ever having made the trade-offs themselves. Security professionals move from technical roles into leadership and discover that the job is mostly about relationships, resources and judgement. Students learn about threats and controls in the abstract, without seeing how they collide inside a real organisation. In practice, technical idealism then clashes with commercial reality.

You can't learn this from a textbook or an exam, so I made a game anyone can play. It's called The CISO Game, and you can play it now at cisogame.mattpalmer.net (Source).

Welcome to Standardised Staples

Standardised Staples is a fictional, mid-sized staple manufacturer with manufacturing, retail and services divisions. Its intranet looks like it was built some time ago, and so do its security controls.

You are its new Chief Information Security Officer. Your job is to get the company ready for the future we all know is coming, without running out of money, losing the board, or losing the company.

In doing this, you'll work with a wide range of characters all of whom have different goals and needs.

What you actually do

The game runs for three years, played as twelve quarters. Each quarter you are briefed on a rising threat and hear from four advisors. Each argues for their own corner: technology, people, governance and insurance, or saving money. None of them knows what attack is coming.

You decide where to spend a limited budget and your team's limited time to improve your cyber security posture. An attack arrives and is tested against your controls.

If it gets through, you run the response against the clock: contain, remove the attacker, recover, and keep people informed throughout. The most serious incidents end in a press conference, where you brief the CEO before facing journalists who have an uncanny knack of finding your weakest areas.

Along the way, the game models the things that are easy to forget when you're drawing up a strategy. Controls you neglect wear down over time. Colleagues and stakeholders seek to influence your decisions. Insurance can soften a loss, but has limitations. A team whose advice you ignore gets less done. And every time you ask the board for more money or people, you spend some of their goodwill, whether they say yes or not.

The game ends when you are fired, when the company goes into administration, or when you survive all twelve quarters. Survivors get one of four outcomes, from Demoted to Promoted to the Board. Everyone gets a written performance review.

Why a game?

Last year I wrote about why compulsory CBTs and phishing tests keep failing. You can force people to tick boxes, but you can't force people to learn. People learn when they are engaged, and when their decisions have consequences they can see.

A game gives you both. You make a call, you see what happens, and you try again with a different approach. Over a few games the lessons that matter most become hard to miss: there is never enough money or time to do everything, advice conflicts, attacks get through even good defences, and how you respond matters as much as what you bought.

There is uncertainty in it, just as there is in real life. Strong controls make an attack much less likely to succeed, but never impossible, and weak ones don't guarantee a breach. Each game draws its scenarios and attacks afresh, so no two are the same.

You won't find the rules and numbers published anywhere, and that is deliberate. A real CISO has to judge risk without knowing the odds. It's about developing professional judgement, not calculation.

Built on real frameworks

It's a game, but it isn't made up from scratch. The eleven control areas you invest in are groupings of the NIST Cybersecurity Framework 2.0. Every attack is described in FAIR terms, with losses split between the direct cost and the fines, lost customers and reputational damage that follow. Incident response follows the containment, eradication and recovery steps of NIST SP 800-61.

These provide a vocabulary and a structure, not a compliance test. The game simplifies a great deal so it can be played in under an hour: a year passes in about ten minutes, and the characters are deliberate caricatures. It is a game, not professional advice.

Play it together

The game can be played on your own, but some of the best conversations come from playing it as a group.

Anyone with an account can host a group game for a class, a seminar or a team, in the room or online. Players join with a three-word code, and up to 40 teams or individuals can take part. Every game in the group gets the same scenarios, the same attacks and the same luck. So when one team survives an attack that sinks another, the difference came from the decisions they made. That is where the discussion starts, and at the end of each year, everyone sees a scoreboard of how each team is doing.

If you sit on a board, why not play it as a board or with your executive team, with an advisor or your own CISO as facilitator?

If you teach, there is a guide for educators.

Why 'Standardised Staples'?

Standardised Staples is not based on any individual company. It draws heavily on my early experience working with a regional development agency as an IT Advisor to industrial and manufacturing companies in the north of England. Whilst most of my career has been spent as a CISO in global financial services, I feel an affinity for companies that make a physical product efficiently and at scale, often at narrow margins, and yet still manage to innovate and reinvent themselves. They are impressively serious about what they do, and yet can also be vulnerable to shocks. They are the companies that the world we live in was built on. They are the sort of company that would really benefit from good security leadership, yet might struggle to obtain it. Standardised Staples is such a company.

How it was made

I designed the game and built it with Anthropic's Claude Code. Each character in the game is unique, and much of what they say to you is written by Claude as you play, in response to your decisions and the events that unfold. The scores are always calculated by the game itself, never by the AI.

Each scenario is based around incidents that really happen. All the scenarios and incidents in the game are ones I have dealt with in practice.

The game runs to about 25,000 lines of TypeScript, React, CSS and SQL: roughly 17,400 for the game itself, 6,100 for tests and 850 for tools such as the simulator. Development ran over a week: 198 code commits, 77 pull requests and 276 design decisions so far.

Over 400,000 simulated games were played by bots to calibrate the game mechanics. The pre-launch balance review alone played 164,000 (41 variants of a strategy, 4,000 games each), with further runs of 20,000 games for close calls.

No personal data is needed, and you don't need an account to play.

Every game also leaves an anonymous record of choices, which over time should tell us something useful about how these decisions are made.

Your turn

Give it 40 minutes. See whether you make it to the Board.

And you don't? We learn far more from our failures than from our wins!

Play the CISO Game at cisogame.mattpalmer.net.