This is the browser equivalent of the resources given to one player in the Threat Agents card game.

To play remotely you should:


A data flow diagram should be drawn on a whiteboard or similar. Every player gets one of each Threat Agent cards placed face up, plus one of these pages.

Each Turn

The player identifies a threat and plays the appropriate Threat Agent to make an attack. This is left face down. Click the card to do this.

Other players must analyse the system and see how the attack could be mitigated or blocked. They can use one of the Counter Agents or explain their domain knowledge. Click on the Counter Agents card to pop up the full size image.

End of Turn

Threat Agents can be turned face up if you have none remaining or were unable to identify a threat. The group may agree that you can turn over all your cards when there are only one or two available to you.

Game Over

The game should end 5 minutes before the end of the meeting. This allows time to agree who should follow up on vulnerabilities.

To learn more about Threat Agents, visit the Threat Agents website.