Dungeons & Dragons: The security tool you didn't know you needed

The speakers start from a common problem: traditional tabletop exercises for incident response often feel scripted and dull. Participants protect their own turf, hold back in front of bosses or peers, or fight the scenario, so little is learned. They argue that engagement drives learning and that a fun format does not make training less serious. They separate game-based learning, where the game itself teaches, from gamification, where a competition is layered onto unrelated material, and point to research supporting collaborative play.

The core of the talk is a role-playing framework they call Hackback. An incident master runs the scenario much like a dungeon master, telling the story and adjusting difficulty so players neither fail nor succeed every time. Players take on characters such as a CFO, a marketing manager or an IT admin, each with modifiers and stereotyped traits that help people get into role. A d20 roll introduces randomness, so well-laid plans do not always work, which mirrors real incidents. The speakers ran a short demonstration of a Friday-afternoon alert about an administrator signing in from an unexpected country, showing how technical and communication choices get debated. They said the same structure can explain concepts such as zero trust, support risk assessments, and run red, purple or ransomware negotiation exercises.

To close, they described a malware-themed collectible game, an open-source plan with a private repository and a community Discord, and a workshop. In questions they said running a session well takes practice and security knowledge, and that teams can use their own runbooks. The main takeaway is that role-play can build empathy across roles and make response practice more realistic.