Riskio

Exploring cyber risk through play

Riskio is a practical, hands‑on way to understand how cyber risk behaves in real environments. It’s built for learning, discussion, and shared insight — not as a commercial product.

Through cards, boards, and realistic scenarios, Riskio helps teams and learners explore:

  • how threats emerge and evolve

  • how decisions influence risk exposure

  • how organisations respond under pressure

It’s a structured, engaging tool for teaching cyber risk, strengthening awareness, and supporting informed decision‑making in workshops, classrooms, and professional settings.

A detailed floor plan of the University Fees Office at the University of Southampton, including reception, customer meeting rooms, workspace areas, and security stations. Additionally, there are graphics related to cybersecurity threats such as phishing, tampering, repudiation, spoofing, denial of service, elevation of privilege, and information disclosure, along with a round table with six people (labeled G, A, 1, 2, 3, 4) viewing various documents and flyers about risk management.

Why is Riskio Exists?

Cyber risk is often explained through frameworks, reports, and technical language. Riskio takes a different approach — it makes risk visible, interactive, and experiential.

By simulating real‑world pressures and decision points, Riskio helps participants:

  • connect abstract concepts to practical outcomes

  • understand how risk accumulates and shifts

  • see how choices affect resilience and exposure

  • explore organisational behaviour under uncertainty

It’s a safe, engaging way to learn, experiment, and reflect.

How to Play

Riskio is designed to be simple to run and easy to understand, even for participants with no technical background. Sessions are facilitated by a cyber‑security professional acting as the Games Master. The game uses cards, boards, and structured scenarios to guide players through decisions that shape how cyber risk develops.

A typical session includes:

Setting the scenario The Games Master introduces the environment, objectives, and initial conditions.

Attack strategy The player acting as the attacker considers potential threats using the STRIDE categories, selects a card at random from the chosen category, and describes the attack using the game board.

Defence strategy Players respond to the attack by selecting an appropriate option from the cards in their defence deck.

Reflection and discussion The session concludes with a Games Master‑led conversation about what happened, why it happened, and how the defenders’ choices relate to real‑world cyber practice.

Riskio encourages collaboration, critical thinking, and shared understanding — making cyber risk more tangible and accessible.

Magnifying glass examining a bug icon with a warning triangle containing an exclamation mark, symbolizing a computer virus or malware alert.

Identify Threats

Magnifying glass with bug icon, warning signs, and a bar graph indicating a virus or malware threat.

Analyse Risks

A digital illustration of a security shield with a padlock in the center, surrounded by connected nodes, with a red warning triangle and exclamation point overlayed, symbolizing cybersecurity alert or threat.

Defend Your Network

Who is it For

  • Riskio is suitable for:

    • educators teaching cyber or risk fundamentals

    • security teams running awareness sessions

    • leaders exploring organisational resilience

    • students learning how cyber risk works in practice

    • anyone who benefits from a clearer, more intuitive view of risk

    No prior technical knowledge is required.

A digital illustration of a shield badge with a blue background and a circle with a diagonal red line through it in the center. Below the circle, the text reads "What Risk Is Not." The badge symbolizes safety or security, with a small red diamond shape and lines indicating alertness or caution.

What Riskio Is Not

Riskio is not sold as a commercial product or service. It is an educational resource designed to support learning, discussion, and shared understanding, and it has been successfully used by organisations in their training and awareness activities.

A blue shield emblem with a white letter 'i' and a red sparkle, containing the text 'About Riskio' indicating risk awareness or safety information.

About Riskio

Riskio was created to make cyber risk easier to understand, easier to teach, and easier to talk about. It blends professional experience, academic insight, and practical design to offer a simple, engaging way to explore how risk behaves in real environments.

Research & Educational Use

Riskio has been used in university teaching, professional workshops, and informal learning environments. It supports introductory threat modelling, defensive reasoning, and cyber‑risk awareness.

Digital illustration of a shield with a padlock symbol, surrounded by security icons and a graduation cap, representing cybersecurity education.

Universities

A digital illustration of a shield with a house and a lock symbol, surrounded by connected nodes. The house has red walls, a red roof, and a flag on top, symbolizing security and protection.

Schools

Illustration of a business presenter pointing at a board with security icons, including a lock and exclamation mark, while two audience members listen.

Corporate Training

Illustration of a government building with a shield and lock symbol, representing cybersecurity and data protection.

Government Agencies

Digital illustration of cybersecurity concepts, including a computer, a lock symbol, a shield, a star badge, a target with an arrow, a globe, and data charts.

Cyber Bootcamps

Proven Research Impact?

Developed through academic research and widely cited within the cyber security education community, Riskio demonstrates the value of game-based learning for security awareness and risk assessment.

Book cover titled 'Computers & Security' with a blue background and digital graphics of a lock, circuit, and a computer mouse.
Book cover titled 'Computers & Security' with a blue background and digital graphics of a lock, circuit, and a computer mouse.

400+

Academic Citations

Verified Google Scholar

Floor plan of a university office with areas for visitor check-in, reception, staff desks, security features, and a meeting room, labeled 'University of Southampton'.
Floor plan of a university office with areas for visitor check-in, reception, staff desks, security features, and a meeting room, labeled 'University of Southampton'.

15+

Countries Riskio game sent to

  • Australia

  • Belgium

  • Canada

  • Chile

  • Denmark

  • Kuwait

  • Germany

  • India

  • Italy

  • New Zealand

  • Netherlands

  • Norway

  • Switzerland

  • United Kingdom

  • USA

Created by Dr Stephen Hart, PhD | CISSP | CISM | CSSP

Lead Security Architect | Cyber Security Researcher