About the game
New job, big budget, 24 months to prove yourself
Security Architect Simulator is a free cyber security management game you play right here in your browser. You're the newly hired, very stressed Security Architect at Harbour & Finch Law, a busy (and fictional) law firm. You decide which security projects to roll out, then watch cartoon attackers try their luck in a 3D cutaway of the office: phishing flocks, a deepfake CEO on the phone, a key-chucking robot and a stripy burglar with a sack.
Every control you add makes the firm safer, but some of them get in people's way, and the budget only stretches so far. Keep the staff productive and the board confident while you plan ahead for the attacks on your Threat Radar. Get through all 24 months without a single breach and the board promotes you to Chief Information Security Officer.
- Genre
- Management sim
- Play time
- About 10–15 minutes
- Months
- 24, attacks from Month 3
- Projects
- 24 across 9 areas
- Languages
- 72, pick at the start
- Price
- Free, no sign-up
How to play
Plan, deploy, defend
- Press Play, then Start. The run opens paused on Month 1, Day 1 with a $100K budget, and a first-day checklist suggests your opening moves.
- Roll out security projects. Each one costs budget up front and takes 1 to 4 months to go live. Every card shows its effect on security posture and productivity, its prerequisites and the trade-off in plain English.
- Watch the Threat Radar. Threat intelligence is running from day one, so you can see each attack up to six months ahead, the posture it needs and which projects can still be ready in time.
- Make the call. Thirteen times a run a colleague brings you a decision, from shadow AI to a supplier's new bank details. The clock stops until you choose, and the best answer is a good call.
- Keep the board on side. Breaches and unhappy staff cost board confidence, and at zero you're fired. A fired run keeps half its score, and so does one you end early from the game's menu (End run, or Close game while a run is on). Survive all 24 months with zero breaches to be promoted to CISO, then claim your spot on the leaderboard.
How your score adds up
Your score is 20 points per point of security posture, 15 per point of productivity, 10 per point of board confidence and 4 per thousand dollars of budget left, plus 120 for every attack blocked and 100 for every good call, minus 150 for every breach. A run that ends early keeps half its score, whether you were fired or chose End run or Close game.
20 × posture+
15 × productivity+
10 × confidence+
4 × $K left+
120 × blocked+
100 × good calls−
150 × breaches=
Your score
Keyboard controls
- SpacePlay or pause
- 123Game speed 1×, 2× or 3×
- POpen or close Security Projects
- TOpen or close the Threat Radar
- ?How to play
- EscClose the open panel or dialog
Pro tip: Security Policies and Email Authentication are free, so start both before you press Play. A project's prerequisites must be finished, not just rolling out, and the board adds $20K in Month 7, so plan your big buys around it. Drag to pan the office and scroll or pinch to zoom.
What you'll learn
Nine layers of defense, 24 real projects
Every project is a real security control, grouped into the nine areas security teams plan around. An attack is blocked only when your posture is high enough and every main area it targets is covered, so no single project saves the day.
Email Security
Stops forged and scam email
- Email authentication (SPF, DKIM, DMARC)
- Secure email gateway
Identity Security
Stolen passwords stop working
- Single sign-on
- MFA: app, then code fobs
- Passkeys (FIDO2)
Device Security
Managed, patched, malware-free
- Device management and encryption
- Endpoint security and XDR
- Patch management and app allowlisting
Governance & Operations
The rules and routines
- Security policies
- Monitoring (SIEM) and automation (SOAR)
- Threat intelligence
Human Security
Staff who spot and report scams
- Security awareness training
- Phishing simulations
- Human risk management
Network Security
In the office and on the road
- Next-generation firewalls
- Zero trust
- Always-on VPN
Data Security
Client files stay inside
Physical Security
Doors, badges and cameras
- Physical security perimeter
Security Testing
Proof it all works
- ISO 27001 certification audit
Office decisions, and the good call
- A supplier emails new bank details.Call them on a number you already know before you pay.
- A USB stick turns up in the car park.Hand it to IT security unopened.
- Marketing wants to paste client files into a free AI tool.Provide an approved one with data protections.
- Sign-in prompts nobody asked for keep coming.Deny them, reset the password and turn on number matching.
- A laptop is left on the train.Report it now so IT can lock the accounts and wipe it.
- A colleague clicked a phishing link, then reported it.Thank them, reset their password and sign them out everywhere.
FAQ
Security Architect Simulator questions
Is Security Architect Simulator free to play?
Yes. It is completely free and runs in your web browser, with no download, account or sign-up. You only pick a gamer alias if you want to put a top score on the public leaderboard. Organisations that use CanIPhish can also assign it to employees as security awareness training, with a private company leaderboard.
What does Security Architect Simulator teach?
How an organisation defends itself, seen from the security team's side. The game has 24 real security projects across nine areas (threat intelligence runs from day one, and the other 23 are yours to roll out): email, identity, devices, governance and operations, people, network, data, physical security and security testing. They range from email authentication (SPF, DKIM and DMARC), multi-factor authentication and passkeys to patch management, phishing simulations and zero trust. Fourteen attacks, from phishing and a deepfake CEO call to credential stuffing and an office break-in, show why security works in layers, and office decisions such as a supplier's new bank details, shadow AI or a USB stick found in the car park teach the safe call.
How is my score calculated?
When the run ends you score points for your security posture, your staff's productivity, the board's confidence in you and the budget you have left, plus 120 points for every attack you block and 100 for every good call in an office decision, minus 150 for every breach. If the board fires you, or you end the run early from the game's menu (End run, or Close game while a run is on), it counts as a loss and keeps half its points. Survive all 24 months with zero breaches and you are promoted to Chief Information Security Officer, whatever your score. Your best score can go on the leaderboard, which lists the top 50 players of all time.
How long does a game of Security Architect Simulator take?
A full run of 24 months takes about 10 to 15 minutes. At the default 2× speed a month passes in 10 seconds, and the clock stops while an office decision or an incident report is open. You can switch to 1× for more time to plan or 3× to speed up, and pause at any time.
What devices and languages does it support?
It runs in any modern browser on desktops, laptops, tablets and phones, held upright or sideways, although a larger screen is best. The 3D office uses WebGL graphics (hardware acceleration); without WebGL the game switches to a dashboard view that plays the same way. You can play in 72 languages: choose yours from the language picker on the title screen.
Using Security Architect Simulator for security awareness training at work? Bring it to your team or start a free CanIPhish account.
