Game Scenarios

Graphic warning of spoofing attack, showing a skull inside a computer monitor, with a red circuit line outline, and a phishing email icon with a bug and a send button, emphasizing cybersecurity threat.
A warning about spoofing attacks, explaining that they are threats to impersonate users and spoof websites or servers, with the title in red bold text and the info in smaller gray font, with a logo reading 'RiskIQ' at the bottom right.
Graphic titled 'Tampering Attack' with subtitle 'Desired Property Integrity' and description about threats that alter data at rest or in transit. Bottom right has the logo 'Riski'.
Graphic warning about tampering attack with a computer virus icon and warning triangle, with the text "Tampering Attack" and "Risiko" in red, green, and gray colors.
Design graphic titled "Reputation Attack" featuring a red skull with circuit lines connected to a laptop, and an icon of a computer window with a mobile device, with the word "Riski" and a power symbol in the bottom right corner.
A sign with the title "Redpudiation Attack" in red text, explaining it involves desired property, non-repudiation, and threats to claim to have not performed an action, with the logo "Riski" in the bottom right corner.
Graphic warning about information disclosure attack with a hacker skull and a computer code symbol, and the RiskIQ logo.
A slide titled "Information Disclosure Attack" discusses threats to the confidentiality of desired property information, with the word "Riski" at the bottom.
Warning sign about denial of service attack with a skull and circuit lines icon, text 'Denial of Service Attack', a server icon with '.404' error, and the company logo 'RiskIQ'.
Slide with the title "Denial of Service Attack" in bold red text, and the subtitle "Desired Property Availability" followed by "Threats to availability of services to users." in smaller gray font. The bottom right corner features the logo of RiskIQ.
Graphic warning about privilege attack risk, with a skull connected to a computer, and a hand holding a crown, indicating elevated privilege levels.
Slide titled 'Elevation of Privilege Attack' with subtitles 'Desired Property Authorisation' and 'Threats against the authorisation controls', with a logo 'Riski' at the bottom right corner.

Example of Tiles from alternative Game Board - Hover over tile to see STRIDE Threat Description

Riskio game boards provide structure for decision‑making. They help teams organise threats, defences, and information cards while progressing through a round of play.

Boards can be themed around fictional organisations or real‑world environments. For example, a board may represent a University Fees Office, a small business, or a generalised organisational layout.

Floor plan of university reception area with reception desk, staff, security camera, fire exit, customer PCs, Wi-Fi, and various office and security equipment.
Diagram of an internal network for a university's head office, showing internet connection, firewalls, servers, routers, switches, desktop computers, customer meeting rooms, wireless access point, smart phone, printers, unencrypted and encrypted laptops, and security features like CCTV and guards.

Double sided Game Board - Click on image to see network diagram

How Boards Support Learning

Boards help players:

  • visualise how risks affect different parts of an organisation

  • organise threats and defences logically

  • prioritise risks based on impact

  • understand how controls interact

  • follow a clear flow during gameplay

The board acts as a guide, not a scoring mechanism. Its purpose is to support structured thinking.

Alternative Board Approaches

Riskio boards can also be based on player‑created diagrams, such as:

  • network maps

  • data‑flow diagrams

  • system architecture sketches

This approach mirrors the method used in Microsoft’s Elevation of Privilege (EoP) game, created by Adam Shostack to help software teams identify security risks during the design phase. Players draw system components and then use cards to explore weaknesses.

This method encourages deeper understanding of how systems are structured and where vulnerabilities may appear.