Make cyber attack and defence decisions. Spot the alert, choose a move, and stop the breach.
Safe simulation
03 · STRATEGY & INTELLIGENCE
RR Cyber Wars
Build your cyber HQ, explore a contested cyber world, scout rival defenses, study confidence-rated intelligence, then prepare, attack, or withdraw. Every mission is a safe fictional simulation with an evidence-based debrief.
Up to 10 moves. One missed critical alert can mean cyber-checkmate.
Choose a scenario
Learn how a suspicious sign-in can lead to account misuse—and how quick containment stops it.
Last attacker move: Not started
♟ Counter-move tipStart the match to see the opponent’s response and a short defensive tip.♟ Opponent moveReady to start.
Ready to playClick “Start your move” to begin. Click Start your move to begin. The attacker will move first.
Choose an attack mode · simulated scenario
Choose a simulated follow-up
A8
B8
C8
D8
E8
F8
G8
H8
A7♟Attacker
B7
C7♞Attacker
D7
E7♝Attacker
F7
G7♜Attacker
H7
A6
B6♙💻EmployeeLaptop
C6
D6♖🔐IdentityLogin
E6
F6♙✉️EmailMailbox
G6
H6
A5
B5
C5
D5
E5
F5♘☁️Cloud appsServices
G5
H5♘📱PhonePersonal
A4
B4♗🌐Web servicePublic
C4
D4♘🛡️SOCMonitoring
E4
F4
G4
H4
A3
B3
C3♙💳FinancePayments
D3
E3♖💾BackupsRecovery
F3♖📶Wi-Fi routerHome network
G3
H3
A2
B2
C2
D2♙🏠Home filesPhotos · docs
E2
F2
G2
H2
A1
B1
C1
D1♔🏢OrganizationCritical asset
E1
F1
G1
H1
Cyber coach · beginner tipYour goal is to protect the organization. Read the alert, choose one response, then see what the attacker does next.
Cyber words made simple
Session: a temporary signed-in connection. Contain: stop the suspicious activity from spreading. Pivot: move from one computer or service to another. Backups: saved copies used to recover after an outage.
Attacker has moved. Your turn: choose a response above the board.
Analyst decision round
Investigate an unusual sign-in
Stage 1 · Triage
Impossible travel sign-inSuccessful sign-in to maya.chen@example.test from Singapore, 11 minutes after a sign-in from London.
Your role: SOC investigator Fictional tenant · case SOC-014
Choose what to do
The alert is a clue, not proof. Choose an investigation step.
Evidence reviewed
●London sign-in used a familiar device and browser.
●Singapore sign-in used a new device and browser.
●A mailbox forwarding rule appeared shortly after the second sign-in.
Illustrative learning prototype · no real accounts, systems, network targets, or telemetry are used.
Connect this lab to GRC
Use the fictional alerts, endpoint events and network evidence from this lab to practice describing a risk, choosing a safeguard, assigning an owner and recording evidence. SIEM, NDR and EDR signals help explain what happened; GRC makes the response measurable and accountable.