Who plays, and who teaches

MSc students aged 24–32, women and men, from Denmark, the rest of Europe and Asia. Engineers by training, often with work experience — not gamers. Three student sketches and one teacher, based on the programme’s intake.

Sofie, 25Danish · BEng, industrial

“Show me why this matters for a real company.”

BACKGROUNDPart-time job at a manufacturer near Herning. Practical, good at processes, little IT security. NEEDSRecognisable companies and situations. Clear link to the exam project. WORRY“Games feel childish and waste time.”

Marco, 29Italian · software engineer

“I want to see the technical detail behind it.”

BACKGROUNDThree years as a developer before the MSc. Knows networks and logins, less about business impact. NEEDSOptional depth: logs, data flows, STRIDE terms on demand. WORRY“Too simple — I’ll be bored and take over the group.”

Linh, 26Vietnamese · technical design

“I need a moment to read before we decide.”

BACKGROUNDEnglish is her second language. Careful and thorough, quiet when the group talks fast. NEEDSShort sentences, time to read, ways to give input without speaking first. WORRY“The fast talkers decide everything.”

Anne, 46Teacher · associate professor

“If setup takes more than five minutes, I won’t use it.”

BACKGROUNDTeaches digital business development. Knows CyPro well, not a game designer. NEEDSOne-click start, control of the room, ready slides and prompts. WORRY“Students play but don’t learn the method.”

One class, from QR code to worksheet

A 90-minute session. The curve shows how it should feel; the risk row shows where it could go wrong, and the design answer shows how we prevent that.

STUDENT DOES — Scans the QR, types a nickname, picks a face, joins a team table. Watches a 60-second illustrated story from the CEO. Walks the top-down office; close-ups open when talking or inspecting; leaves sticky notes. Phone buzzes. Follows clues room to room. Tells the CEO what to do. Sees all teams’ notes on the projector; real CyPro terms appear. Downloads the team’s CyPro threat table. HOW IT FEELS COULD GO WRONG Setup fails on a projector laptop. Network blocks it; people wait. Rules dump; eyes glaze over. One player drives, others watch. Teams get lost. Stress without a clear finish. Fun but no learning link. Nothing to reuse. DESIGN ANSWER Pick a ready scenario, press Start. Works in any browser. HTTPS only, works on eduroam. In under 30 seconds. Story first. Goal pinned on screen all game. Everyone walks; each owns rooms. Room checklist, team on map, private notes first. Clue counter, timer, one final choice, finish screen. Reveal: sticky note = threat, room = component, crate = asset. Export to the CyPro table, ready for reports. TEACHER Chooses company, scenario, 45 or 90 min. Watches teams fill the lobby. Presses Start for all. Sees every team live; sends hints. Can pause the whole class. Uses ready prompts and “surprises”. Downloads a class summary.

What you do, and what you learn

The game layer (top) is what students experience. Each step quietly covers a CyPro step (blue labels). One loop — walk, look closer, write a note — repeats until time is up.

Anatomy of a sticky note

ON: LABEL PRINTER Anyone on the guest Wi-Fi could stop it on Black Friday. It would: stop the work Who: a visitor or driver Likely? Seen in companies like ours — Laura

On: a thing or a room→ asset and component in the system model

What could go wrong→ the threat, in the student’s own words

It would leak / change / stop→ confidentiality, integrity, availability

Who might cause it→ threat actor

How likely→ CyPro’s own four likelihood levels, in plain words

Likelihood without jargon

CyPro already offers a simple four-step likelihood scale based on experience. The game uses exactly those steps, so the notes drop straight into the CyPro threat table.

1Could happen in theory

2Heard of it elsewhere

3Seen in companies like ours

4It has happened here

Each team member writes notes privately first, then the team sees them together and merges duplicates. This gives quieter players a voice and mirrors CyPro’s advice to vote before discussing.

Three screens, one session

Students play on their own laptop or phone, the class sees the projector, and the teacher steers from a control view. All three stay in step through one live session room.

JoinThe storyWalk and spotThe dayTalk it throughAfter

All three views connect to one session room over a normal secure web connection. The room holds positions, notes and the clock while the class plays, and disappears a few hours after the session ends.

Eight rules every screen follows

Each rule comes from a well-known UX law or guideline, turned into something concrete for this game, so designers, developers and reviewers can check the same things.

Accessible by default

WCAG 2.2 level AA is the baseline, in line with what public-sector sites in the EU must meet. Text keeps a 4.5:1 contrast. Colour never carries meaning alone: risk levels also have numbers, and teammates have initials. Everything works with the keyboard — arrow keys to walk, Tab to reach rooms and buttons — and screen readers get a room list as an alternative to the map. Animations respect the “reduce motion” setting.

How we know it works

Time from QR scan to being in a teamunder 30 s Students who can say the goal after the story9 in 10 Every team member leaves at least one noteyes System Usability Scale after the pilot75 or higher Teacher setup timeunder 2 min

Design system: calm office, warm people

Cool, light interface colours so the game feels like a grown-up tool. Warm colours are kept for people, illustrations and sticky notes — the things we want students to notice.

Components

BUTTONS

Stick itAsk more

CHOICE CHIPS

Stop the workLeak information

Server cupboard isn’t locked — Wei

STICKY NOTESlight tilt, author initial, max 80 characters on the map

Laura

WWei

AVATARSYou: blue ring. Teammates: initial + name.

DIALOGUE CARD

Jana · Packing lead
Nobody here paused it.

STATUS

8:12 leftClues 2 / 4Orders stoppedPrevented

ROOM TILE (TOP-DOWN)

Packing station2 people · 3 things

ALERT TOAST

08:04 · Sofie: nothing has printed since 07:52!

Design assets: one cast, one building, many stories

The cast (illustrated close-ups)

KarinCEO, 4th generation

JanaPacking lead

AhmedPart-time IT

ElenaAccounting

MeiWebshop manager

LukasNew intern

Each person has a bust for close-ups and a small round token for the map. Plus Tomas (driver) and Rasa (factory contact, Lithuania).

Room tiles (top-down)

Webshop

Accounting

CEO

Meeting

Reception

Server

Packing

Warehouse

Loading dock

Dye works

Cloud: webshops

Factory, LT

Join in 30 seconds

Left: a student’s phone or laptop. Right: the projector lobby. Three steps — code, name and face, team — and the student is in.

10 / 15

Nordknit, Sunds

Your goalBlack Friday is in 3 days. Find what could stop an order reaching a customer.

14:20 left

LWKS

11 / 15

12 / 15

13 / 15

BLACK FRIDAY · WHO SAW IT COMING?

What happened	Blue	Green	Yellow	Lilac	Red
Printer stopped via guest Wi-Fi	✓	✓	½	–	✓
Fake “printer service” at reception	–	✓	–	–	½
Webshop slow under 10× traffic	✓	½	✓	✓	–

✓ on a note½ close, wrong place or person– missed

?

QUESTION FOR THE CLASSGreen door spotted the fake technician. What made you look at the visitor book?

NOW YOU KNOW THE NAMES What you did has a name in the CyPro method

Rooms you walked→System model

Things worth protecting→Assets

Where data left the building→Trust boundaries

Your sticky notes→Threats

Leak · change · stop→C · I · A

Who might cause it→Threat actors

1–4 how likely→Likelihood

Next class: risk management — which of your notes would you fix first, and what would it cost?

14 / 15

Material in the kit

Facilitator guideMinute-by-minute run sheet for 45 and 90 minutes, with what to say at each step.

Slide deckIntro, CyPro recap and debrief slides that match the game words to the method.

CyPro threat worksheetPrintable table, also filled automatically from each team’s notes after the game.

Paper backupPrintable floor plan and character cards, so the class can still run if the network fails.

Reflection questionsShort individual questions to link the game to the exam project.

Scenario writing guideTemplate for adding a new company or a new bad day — text only, no coding.

15 / 15