Dungeons & Dragons - The security tool you didn't know you needed

The talk opens with a critique of common security training. Computer-based modules are often clicked through, and tabletop exercises can become dull, one-sided discussions where a few people dominate, others stay quiet, and participants push back against the scenario. The speaker separates game-based learning, where the game itself teaches, from gamification, where points or rewards are layered onto existing work. Social learning, immersion, psychological safety and empathy are presented as the reasons role-playing can open people up.

The core of the session walks through Hackback, a framework for running scenarios led by an Incident Master. It has been used mainly for incident response, but the speaker also describes it applied to risk management, zero trust, threat hunting, and red, blue and purple team exercises. Players take roles outside their own job, which builds empathy and tends to draw out more candid feedback about process gaps. Dice rolls introduce realistic failure, such as discovering during a restore that backups were incomplete. Malware and Monsters, a creature-collection theme built around malware families, adds prepared material so less experienced facilitators can run games. A sample Azure incident shows how players weigh options under pressure.

The session closes with open-source materials, an Incident Master handbook, and an invitation to contribute scenarios and help grow the community Discord. The takeaway is that structured play can expose gaps that lectures and scripted tabletops tend to miss.