Critical Decisions — Detect · Decide

Incident Response Card Game

Earn Scenario cards by presenting the most relevant incident response decisions. Discussion-driven — multiple answers may be valid. Defend your reasoning.

How to Play Game Setup

SCENARIOS

CRITICAL
DECISIONS

Detect · Decide · Defend

CYBER CHAOS
DECK

ANSWERS

CRITICAL
DECISIONS

Detect · Decide · Defend

CYBER CHAOS
DECK

SCENARIO

Scenario

A user reported they may have clicked a phishing email. What do you check?

ANSWER

Answer

Check the EDR logs.

Logs may include threats, process info, registry changes, user activity, network logs, and file integrity.

Before You Begin

Game Setup

Everything you need to know before the first card is drawn.

The Decks

Place the Scenario Deck and Answer Deck in the center of the table, face-down.

Starting Hands

Each player draws 7 cards from the Answer Deck to form their starting hand. Keep cards hidden from other players until played.

Players

Works best with 3–8 players. One player acts as the Incident Captain each round — this role rotates clockwise after every round.

Winning

The game ends when you want it to. The player who has collected the most Scenario cards as points wins.

Round by Round

How to Play

Each round follows five steps. Rounds typically run 5–10 minutes.

Select the Incident Captain

One player is designated as the Incident Captain for the round. They draw a card from the Scenario Deck and read it aloud. They may add context or details to enhance realism, but should remain consistent when answering questions from other players.

Submit Responses

All other players select one Answer card from their hand that represents their best response or next action. Each player presents their card and briefly explains their reasoning.

No suitable card? Draw one card from the deck and discard one from your hand. The newly drawn card may be played immediately if applicable. If no strong option exists, choose the most defensible answer available and justify your decision.

Select the Best Response

Once all responses have been presented, the Incident Captain selects the answer they believe is most effective and explains their reasoning to the group. Their decision is final.

Scoring

The player with the selected response receives the Scenario card as a point.

Reset for Next Round

All played Answer cards are placed in a discard pile. Each player draws from the Answer Deck to return to 7 cards in hand. The Incident Captain role rotates clockwise and a new round begins.