Game Card Types

Riskio uses three types of cards to simulate cyber‑security scenarios: Threat (Attack) Cards, Defence Cards, and Information Cards. Each card type plays a different role in helping players understand how risks emerge and how controls reduce them.

A digital graphic about a 'Reputation Attack,' describing how attackers fraudulently alter digital signature verification processes. It includes icons of a computer, a signature, and a logo with the words 'RiskIQ'.
Book cover titled 'Risk' and 'Reputation', featuring digital and technological graphics, with the University of Southampton logo.

Hover to see card front

Threat Cards

Threat Cards describe realistic cyber‑security threats based on the six STRIDE threat categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service and Information Disclosure. Examples of threats that organisations may face include:

  • phishing

  • unauthorised access

  • malware

  • insider threats

  • data loss

  • weak authentication

Each threat introduces a scenario that teams must analyse and respond to using appropriate defence cards.

An informational graphic about securing laptops and PCs by removing default user accounts and services, with icons of a computer lock and a document, and the number 2 indicating a step.
Book cover titled 'Risk to Defence' by University of Southampton, featuring a blue shield emblem and digital code background.

Hover to see card front

Defence Cards

Defence Cards represent security controls, policies, and practices that reduce risk. Examples include:

  • secure configuration

  • access control

  • monitoring and logging

  • patch management

  • training and awareness

  • incident response

Players select defences that best mitigate the threat presented. The value lies in discussing why a defence is appropriate and how it works in practice.

Book cover titled 'Risk to Information' with logos of University of Southampton and an icon of a power button integrated into the word 'Risk.' Background features digital binary code and data streams.
Infographic about weak authentication, showing that 20,000 users can access a server with just a username and password, emphasizing the risk of weak security.

Hover to see card front

Information Cards

Information Cards provide additional context that may increase or decrease risk. Examples include:

  • weak secure configuration

  • high staff turnover

  • outdated systems

  • strong leadership support

  • limited budget

These cards help players understand how organisational factors influence cyber‑security outcomes.

How Cards Are Used During Play

A typical round involves:

  1. The Player acting as attacker selects a threat card from six STRIDE categories (placed face down next to game board).

  2. Teams selecting defence cards to mitigate the risk.

  3. Information cards being introduced to modify the scenario.

  4. Teams explaining their reasoning.

  5. Reflection on how the chosen defences would work in real life.

This process encourages critical thinking and collaborative decision‑making.

Book cover titled 'Risky Spoofing' from the University of Southampton, featuring digital and cybersecurity-themed graphics.
Information card about a spamming attack, showing icons of a computer virus and email, with text explaining that an attacker sends an email targeting a specific user, from RiskIQ.

Attack Example using Spoofing Attack

  1. Cyber Criminals – “Attacker gathered information from corporate website and used this to create emails to target employees in a phishing attack”.

  2. Cyber Criminals – “Attacker gathered information from corporate website and used this to create emails to target employees in a spear phishing attack. The employees click on the link and installs a key logger enabling the attacker to gather user names and passwords”

Games Master role to explain perfect attack has: Threat Actor (Cyber Criminals); How they gathered information; Target of attack; Method in attack; and motive (Gather usernames and passwords).

Cover of a publication titled 'Risky Defence' from the University of Southampton, featuring a digital background with binary code and a shield emblem.
An infographic about secure system configuration with icons of a database and shield, a number 3 in a circle, and the word 'Risk' with a power symbol in 'Risk'.

Defence Example

Three different examples of defence to spear phishing attack.

  • Card 3 Secure Configuration: “Configure the Email server to verify the IP Address of the incoming email domain and put in spam folder where does not match”.

  • Card 7 Security Training: “Strategy to detect spear phishing emails by training staff how to spot spoofed emails and implement a intranet based training solution for staff to test their skills”

  • Card 3 Secure Configuration: “Install a behavioural based end point detection system and if user does click on spear phishing email the system will automatically prevent any data loss or malware being installed”

Cover of a publication titled 'Riski Information' from the University of Southampton, featuring digital graphics, a power symbol, and binary code background.
Page 3 of a cybersecurity guide with the title "Weak Secure Configuration" discussing how staff roaming profiles can cache private files on an unencrypted PC, with the RiskIQ logo at the bottom.

Information Example

The Games Master can select this card to helps players understand that poor configuration choices create vulnerabilities even when good technology is in place.

“Weak secure configuration means systems are set up in a way that makes them easier to attack — for example, default passwords, unnecessary services enabled, outdated settings, or misconfigured permissions. Even strong security tools fail if the configuration behind them is weak.”

Alternative Games Master can use this information card to act as the attacker.