Three branching security simulations. Every choice is a real control. The attack comes later, and your earlier decisions decide whether it works.
Most security training is a slideshow people click through on a Friday. Breach Arcade hands you the budget, the deadline and the pressure, then shows you exactly which of your choices let the attacker in.
All three games share one structure. The consequences of a choice can arrive a hundred days after you make it.
Build under pressure. Each choice adopts, skips or pays for a real control, and moves three meters. Premium options lock when you can't afford them.
An incident arrives. Its outcome is computed from your earlier choices, and the game reads back, control by control, what held and what the attacker found.
The board, the customer or the investor decides your fate. You get a score, a letter grade and a place on the high-score table.
Theo wants one shared service account for every agent. Dana wants each agent to carry its own cryptographic identity.
Same doctrine, three very different jobs. Each game switches between a 1980s phosphor terminal and a modern display, whenever you like.
A CISO Adventure
Your chief executive promised the board autonomous AI agents in ninety days. You have a deputy with strong opinions, a CFO guarding the budget, and an adversary that never gets tired. Build the program, live through the breach it was built for, then face the examiners who want every agent action traced to its trigger.
A Modern Security Practitioner Adventure
An insurer will sign a $4.2 million contract if your agent product passes a 212-question security review. You have eight months of runway, and every control costs engineering time. Then you learn what a breach looks like from the vendor's side, just as a hospital signs on as your second customer.
An AI Security Simulation
Secure an agentic assistant and a fraud model in thirty days, on a thin budget. Red-team your own systems, then face an adversary drawn from four profiles, from a lone hobbyist to a state-aligned crew. Only the controls that matter against that attacker count, and the second month after launch brings the quiet failures.
Your agents need to prove who they are to the payment rails. Engineering suggests the vendor's static API keys, rotated every ninety days. It passed last year's audit.
Pick an answer. The game remembers it, and a hundred days later it decides whether a stolen credential still works.
| Zero Trust | Blast Radius | Attack Surface | |
|---|---|---|---|
| You play | CISO of Cascade Trust Bank | Founder-CTO of Nimbus Loop | First AI Security Lead at Northstar Services |
| The pressure | A 90-day deadline for AI agents in production | A $4.2M contract gated by a 212-question review | Thirty days to launch two AI systems |
| The incidents | A poisoned email turns your agent against customer data, then a regulator's examination and a second wave | Your product is breached inside your customer, then three attacks at once across two customers | One of four adversaries, drawn at random, who comes back in the second month |
| Meters | SEC · BGT · TRT | SEC · RUN · DEAL | PSTR · BDGT · TRST |
| Scenes / endings | 76 / 9 | 82 / 10 | 70 / 7 |
| Run length | 40–50 min | 40–50 min | 30–40 min |
| Best for | Security leaders and managers | Founders and vendor-side teams | AI and ML practitioners |
Yes. These three games are free to play in your browser right now, with no account and no sign-up. Attack Surface, our first prototype, will stay free. We're building a library of dozens more games, which will be part of a Breach Arcade membership. Joining the founding list is optional.
A growing library of security simulations across different careers and threats, with new games added regularly. Pricing isn't set yet. People on the founding list hear first, get early access, and help decide what membership includes.
No. The games play right here in any modern browser, on desktop or mobile. There's nothing to download or install.
In the player's own browser. Nothing is sent to a server, so there's no personal data for you to manage. Clearing browser data resets progress.
Between 30 and 50 minutes. Progress saves automatically, so a run can span several sittings, and most players replay to reach a better ending.
Yes. Put the game on a shared screen and let the room vote on each decision. A run fits comfortably in a 45-minute session, and the incident readback gives the group plenty to argue about.
A short email when a new game ships, first word when membership opens, and the occasional note on the security ideas behind the games. Every email has an unsubscribe link, and we never share your address.
These three games are free. Dozens more are on the way as part of a Breach Arcade membership. Join the founding list to play new games early and help shape what membership becomes.