WHY THIS GAME EXISTS

• Builds intuition for how grid cyber crises unfold and how they are stopped.
• No operational content. Attack cards are abstract; zero real methods.
• The deep, accurate mechanics are on the defender side: monitor, detect, isolate, controlled shed, manual fallback, black start, and crisis communication.
• The attacker role teaches empathy for the defender: you feel why early detection and resilience matter.

✓ WHAT YOU LEARN

• The shape of a cyber attack on critical infrastructure: how a kill-chain builds from recon through foothold and lateral movement to impact.
• Why early detection is essential: every turn sooner you detect saves exponential damage.
• The defense cycle: monitor → detect → isolate → restore → communicate.
• Trade-offs in crisis response: segmenting protects but restricts; shedding costs now but saves later.
• Societal impact: a power outage hits hospitals, water, telecom, and public order simultaneously.

• 1 · Kill-chain (attacker): recon → foothold → lateral → staging → impact. Stay below the detection floor; then unleash a surge.
• 2 · Defense (the deep system): monitor → detect → isolate → restore → communicate. Early detection beats late heroics.
• 3 · Playing cards: pick a card at the bottom, then tap a node on the map to execute it. Every action costs resources.
• 4 · Winning: the attacker wants a regional blackout; the defender keeps society online until the 52-hour clock runs out.

CAUSAL DEBRIEF — DECISIONS & CONSEQUENCES

WHAT REALLY HAPPENS

• Ukraine 2015: attackers opened breakers, ~230,000 people blacked out — operators took over substations manually.
• Ukraine 2016: more sophisticated impact; prepared operators broke the cascade.
• Black start: restarting a fully blacked-out grid from black-start units — slow, crucial.
• The lesson: early detection beats late heroics. Segmentation and visibility save lives.