Hack Your Board's Mindset: Closing the Strategy-Operations Gap via Board Game Simulations

Hack Your Board's Mindset: Closing the Strategy-Operations Gap via Board Game Simulations

Speakers: Yi-Hsien Chen, Lead of AI Application Team, CyCraft Technology

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=zGVX5-zIu8s

Overview

In the realm of cybersecurity, a persistent and often overlooked challenge is the communication chasm between an organization's strategic leadership (the board) and its operational security teams. While significant budgets are allocated to advanced tools and defensive products, many organizations continue to fall victim to attacks, leading to a critical question: why do we still fail? This talk by Yi-Hsien Chen, a security researcher and AI application lead at CyCraft Technology, delves into this crucial "strategy-operations gap," asserting that it stems not from a technical deficit, but from a fundamental learning gap.

Chen, joined by co-producers Weijia Gao and Dengji Lin, introduces an innovative solution: gamified education through custom-designed board game simulations. The presentation outlines the inherent flaws in traditional cybersecurity training—passivity, rapid forgetting, and a lack of shared mental models—and proposes an alternative rooted in experiential learning. By allowing decision-makers to "learn by feeling" through comprehensive, emotionally vivid play, these board games aim to bridge the cognitive divide, fostering a unified understanding of risk, trade-offs, and defense strategies across all organizational levels.

The talk introduces two distinct board games, CyberCamp and Cyber Crisis, each tailored to address specific aspects of this learning gap. CyberCamp focuses on strategic investment decisions for board members using the Cyber Defense Matrix, while Cyber Crisis immerses operators in real-time incident response challenges guided by the Continuous Threat Exposure Management framework. Through these simulations, organizations can develop more robust defensive postures by cultivating engagement, compressing learning time, facilitating tactile understanding, and providing a psychologically safe environment for trial and error, ultimately aligning strategic vision with operational execution.

Background

▶ Watch: Core problems of current cybersecurity training (2:00)

The premise of this talk is built upon the observation that despite substantial investments in cybersecurity, organizations frequently fail to prevent successful attacks. This failure is often attributed to a fundamental disconnect between those who set strategy and those who execute it. Yi-Hsien Chen identifies three core problems with current cybersecurity training methodologies that contribute to this "learning gap":

1. Information Transfer Problem: Technical staff possess deep knowledge, but this expertise often fails to transfer reliably to decision-makers who fund and govern cybersecurity initiatives. Traditional reports and lectures are passive, leading to boredom, confusion, and rapid forgetting. Decision-makers tune out, preventing the formation of a shared understanding of complex threats and defensive measures.
2. Feedback Latency Trap: Unlike software development, where errors yield immediate feedback in testing, cybersecurity decisions often take months or even years to manifest their true impact. When feedback does arrive, it typically signifies a successful attack and a loss already incurred. This high failure cost combined with delayed feedback discourages bold decision-making, leading executives to either defer decisions or opt for superficially safe, rather than genuinely risk-reducing, choices. Real-world penetration testing, while valuable, is too expensive and infrequent to serve as a continuous learning loop.
3. Cognitive Gap: A profound difference exists in how board members and operators perceive cybersecurity incidents. Operators confront evolving technical challenges—initial access, lateral movement, tool coverage gaps, specific attacking techniques—requiring immediate, detailed technical responses. Conversely, boards view incidents as line items, reputational risks, and trade-offs against broader business goals, focusing on hiring, budget, and peer company incidents. Without a shared mental model, the board cannot truly grasp operator needs, nor can operators fully understand the strategic rationale behind board decisions. This divergence prevents cohesive, effective defense.

To overcome these deeply ingrained issues, Chen argues that merely providing more lectures or briefings is insufficient. Instead, a paradigm shift is needed: organizations must "learn by feeling," allowing decision-makers to experience the pressure, threats, and trade-offs firsthand through comprehensive, emotionally vivid play. This approach provides a psychologically safe arena for trial and error, where participants can experiment with strategies and learn from simulated failures without real-world consequences, thereby accelerating the development of robust defensive strategies.

Key Findings

▶ Watch: Explaining Cyber Defense Matrix and CTEM frameworks (10:40)

The central discovery presented in this talk is that gamified education, specifically through board game simulations, offers a uniquely effective solution to the pervasive "strategy-operations gap" in cybersecurity. Yi-Hsien Chen highlights four core benefits that enable these games to transcend the limitations of traditional training:

1. Engagement as a Gateway to Learning: Unlike dry lectures, board games inherently foster emotional and cognitive investment. By gamifying complex concepts like the Cyber Defense Matrix (CDM) and Continuous Threat Exposure Management (CTEM), the games make difficult ideas "sticky." Players remain actively engaged for extended periods, with 60-90 minutes of gameplay feeling like 30, ensuring that knowledge is absorbed and retained more effectively.
2. Time Compression: The games dramatically accelerate the feedback loop. Real-world attack and defense dynamics that might unfold over months or years can be compressed into roughly 60 minutes of play. This allows participants to witness the immediate and memorable consequences of their decisions—for example, a misguided investment at minute 10 leading to a simulated ransomware crisis at minute 30. This rapid consequence-feedback cycle reshapes mental models far more efficiently than any post-incident review.
3. Tactile Learning: Moving beyond abstract PowerPoint reports, the games incorporate physical resource tokens and cards. The act of physically handing over budget tokens makes the pain of limited resources and the reality of trade-offs tangible and profound. Risk transforms from an abstract concept into a physical item in hand, replacing one-way explanations with a shared physical experience that deepens understanding.
4. Risk-Free Failure: Perhaps the most crucial benefit, board games provide a psychologically safe environment for trial and error. Participants can experiment with diverse strategies, even those that lead to simulated bankruptcy, without fear of real-world repercussions. This freedom to fail allows executives to internalize the lessons from ineffective strategies and proactively develop more robust defensive plans, fostering resilience and adaptability that would be impossible to cultivate through real-world mistakes.

A critical underlying principle emphasized is that "the mechanism teaches, not the theme." The effectiveness of these games doesn't lie in their superficial presentation but in the underlying frameworks and rules that govern gameplay. The games are meticulously designed around established cybersecurity frameworks—the CDM for strategic investment (addressing "space allocation") and CTEM for operational prioritization ("time allocation"). By engaging with these mechanisms, both board members and operators are guided towards a shared mental model, enabling them to understand each other's perspectives and work in concert, thereby closing the strategy-operations gap.

Technical Deep Dive

▶ Watch: CyberCamp demo: Comparing defense strategies (14:50)

The effectiveness of CyCraft's gamified learning approach is fundamentally rooted in its integration of two widely recognized cybersecurity frameworks: the Cyber Defense Matrix (CDM) for strategic decision-making and Continuous Threat Exposure Management (CTEM) for operational prioritization. These frameworks provide the robust "mechanisms" that teach players the core principles of effective cybersecurity.

For the strategic, board-level perspective, the game leverages the Cyber Defense Matrix (CDM). The CDM challenges the common misconception that cybersecurity is merely a shopping list where more tools equate to greater safety. Instead, it frames cybersecurity as a resource-constrained balancing act. The matrix is a 5x5 grid:

• Across the top: The five functions of the NIST Cybersecurity Framework: Identify, Protect, Detect, Respond, and Recover.
• Down the left side: Five classes of assets: Devices, Applications, Networks, Data, and Users.

This creates 25 distinct cells, representing a comprehensive coverage map of an organization's defense posture. The core lesson here is that resources are mutually exclusive. Players have a limited budget, and funding one cell inevitably means another goes exposed. The game forces players to feel this trade-off directly, deciding where to spend and what risks they are willing to accept. This addresses the "allocation in space" problem for boards, guiding them to optimize investment across the entire matrix rather than over-investing in a single area (e.g., buying ten detection products for devices while leaving users or data completely uncovered).

For the operational, security team perspective, the game integrates Continuous Threat Exposure Management (CTEM). CTEM refutes the myth that security simply means fixing every "red" vulnerability reported by a scanner. Acknowledging that the attack surface is too vast to patch everything, CTEM advocates for risk-based prioritization. Its goal is to block the critical paths that lead to an organization's most important assets, rather than indiscriminately patching every vulnerability. CTEM is presented as a continuous, five-stage loop:

1. Scoping: Deciding what assets truly matter to the business.
2. Discovery: Actively finding exposures and vulnerabilities.
3. Prioritization: The "heart" of CTEM, deciding which exposures to handle first based on business value and real risk, not just scanner output.
4. Validation: Confirming that identified exposures are truly exploitable from an attacker's perspective.
5. Mobilization: Actually getting the team to act on the prioritized items.

This continuous loop addresses the "allocation in time" problem for operators. The lesson is simple: "Don't just patch, patch to what matters most." By embedding these frameworks into the game mechanics, players internalize the principles of strategic resource allocation and risk-based operational prioritization in an engaging and memorable way.

Demo / Proof of Concept

▶ Watch: Talk's key takeaways: Learning by feeling (28:50)

The talk effectively demonstrates the application of these frameworks through two distinct board games: CyberCamp and Cyber Crisis.

CyberCamp: Strategic Portfolio Thinking for Boards

CyberCamp is designed for strategic decision-makers, focusing on the Cyber Defense Matrix (CDM). It's presented as a Monopoly-style game where players navigate a loop representing a one-year calendar, encountering various incidents. These include "national days" (holidays with higher attack likelihood, requiring drawing two attack cards), "conference and policy" spaces (opportunities to improve defense), and "uncertain attack" spaces (drawing one attack card).

A key simulation example illustrates two contrasting strategies: "Fortress Builder" (investing heavily in early-stage defense) versus "Defense in Depth" (covering every layer). Both start with a budget of 20,000.

• Initial Defense: Strategy A (Fortress Builder) might buy "rating" for device/application identification. Strategy B (Defense in Depth) might buy SAST and DAST for application identification.
• Attack Scenario (Mimikatz): When an attack like Mimikatz (targeting devices, with higher loss in later stages) hits, the game reveals the effectiveness of each strategy. Defense cards (e.g., Antivirus 2, EDR 4) have a probability of successful defense. In the simulation, Strategy A, lacking layered protection, fails to stop Mimikatz early and incurs a significant loss (e.g., 4,500). Strategy B, with EDR covering detection, might stop the attack later, incurring a smaller loss (e.g., 3,000).
• Later Attack (Chimera Skeleton Key): A more advanced attack like "Chimera Skeleton Key," which bypasses initial identification and protection stages, further highlights the value of defense in depth. Strategy A, focused solely on early defense, is fully bypassed and loses 6,000. Strategy B, with layered defenses like EDR in detect/respond, still has a chance to mitigate the loss.
• Loss Curves: The game models different attack types with varying loss curves. "Insider attack" might have a front-loading curve (higher initial loss), while "double payment ransomware" might have a later-stage curve (loss increases in recovery). This teaches that different attacks require different defensive strategies, not just "the strongest wall."
• Catch Rate: The simulation shows that while the best single layer might offer a 75% catch rate, an accumulated "defense in depth" strategy can achieve a 99% catch rate, demonstrating that "each layer reinforces the next."
• P&L Analysis: After two attacks, Strategy A (2,000 spent on defense) lost more than Strategy B (7,000 spent on defense), resulting in Strategy B having a slightly better net position (e.g., 778 risk). This reinforces the lesson: "Risk represents probability and cost, not luck."
• Customization: CyberCamp also includes "character cards" that assign industry-specific characteristics, allowing players to protect assets based on their industry's unique risk profile (e.g., finance losing more on users, e-commerce caring more about networks and data).

Cyber Crisis: Operational Teamwork for Operators

Cyber Crisis is designed for security teams, emphasizing the Continuous Threat Exposure Management (CTEM) framework. It addresses the realities of limited resources, endless tasks, and the necessity of collaboration in a security team.

• Team Sport: The game simulates a security team of six roles (e.g., threat intelligence researcher), each with specific strengths but also capable of performing other actions, mirroring real-world scenarios where team members must adapt.
• CTEM in Action: Players learn to define, prioritize, and validate continuously. They encounter scenarios through three lenses: the hacker's perspective, asset review, and the enterprise security team's actions.
• Attack Playbooks: Attackers are governed by predefined playbooks (e.g., APT and Ransomware), each with different targets and movement patterns. Ransomware, for instance, tries to infect as many assets as possible, forcing defenders to prioritize stopping its spread.
• Enterprise Asset Permission Topology: The game map represents an organization's intranet, with nine groups of digital assets and intricate connection relationships. Players must understand which assets and paths are critical for an attacker to exploit and how to block or patch these routes.
• Resource Management: Players spend "action points" to discover and patch vulnerabilities, collect intelligence (labeled by category, requiring specific intelligence types for mitigation), and prioritize their moves each round under pressure. This discipline of prioritization based on business value and real risk is a core teaching point.

Both games collectively aim to provide a holistic, experiential learning environment that bridges the strategic and operational divide, ensuring that both boards and operators share a common understanding and vision for cybersecurity.

Defensive Implications

▶ Watch: Q&A: Calibrating game costs and defense probabilities (31:00)

The insights gained from the CyberCamp and Cyber Crisis simulations offer several critical defensive implications for organizations aiming to bolster their cybersecurity posture and close the strategy-operations gap.

1. Cultivate a Shared Mental Model: The most fundamental implication is the necessity of establishing a common understanding of cyber risk, threats, and defensive strategies across all organizational levels. Boards must move beyond abstract line items to grasp the technical realities faced by operators, while operators need to understand the strategic, business-level implications of their actions. Experiential learning, as demonstrated by these games, is a powerful tool to forge this shared perspective, allowing for more coherent and effective decision-making.

1. Embrace Risk-Based Prioritization (CTEM): Organizations must abandon the exhaustive, "patch everything" mentality. The Continuous Threat Exposure Management (CTEM) framework teaches that resources (time, budget, personnel) are finite, and the attack surface is vast. Defenders should prioritize actions based on the criticality of assets to the business and the real exploitability of vulnerabilities, not just scanner output. This means continuously scoping what matters most, discovering exposures, prioritizing based on risk, validating attacker paths, and mobilizing teams efficiently.

1. Invest in Defense in Depth (CDM): The Cyber Defense Matrix highlights that a robust defense requires balanced investment across all five functions (Identify, Protect, Detect, Respond, Recover) and all five asset classes (Devices, Applications, Networks, Data, Users). Over-reliance on a "strongest wall" in one area is insufficient against sophisticated attacks. Organizations should strategically allocate resources to create multiple layers of defense, recognizing that each layer reinforces the next, significantly increasing the accumulated catch rate of attacks and reducing overall loss.

1. Recognize Cybersecurity as a Team Sport: The Cyber Crisis game underscores that effective incident response and ongoing defense are not the work of a single "hero" but require seamless collaboration among diverse security team roles. Each role has unique strengths, but the game teaches the importance of cross-functional communication and the ability for team members to adapt and perform duties outside their primary focus when urgent situations demand it. This necessitates clear understanding of roles, responsibilities, and decision-making authority under pressure.

1. Understand Attack Paths and Asset Relationships: The intricate asset permission topology in Cyber Crisis emphasizes that attackers exploit the connections and pathways within an enterprise network. Defenders must proactively map and understand these critical connections, not just individual assets. By identifying and blocking crucial attack paths—even those they "didn't know they had"—organizations can significantly disrupt adversary movement and protect high-criticality assets.

1. Leverage Intelligence as a Weapon: The games highlight the value of threat intelligence. Collecting and utilizing relevant intelligence allows defenders to understand attack methodologies, anticipate adversary moves, and effectively mitigate vulnerabilities. Without timely and accurate intelligence, defensive actions can be reactive and less effective.

In essence, the defensive implications revolve around shifting from passive knowledge consumption to active, experiential learning that fosters a pragmatic, risk-aware, and collaborative approach to cybersecurity, aligning strategic vision with operational realities.

Key Takeaways

• Cybersecurity is a Learning Gap, Not Just a Technical Gap: The primary challenge isn't a lack of budget or advanced tools, but a fundamental misunderstanding and misalignment between strategic leadership and operational teams.
• Learn by Feeling, Not by Reading: Traditional training is ineffective. Gamified simulations allow decision-makers to experience the pressure, trade-offs, and consequences of their choices in a risk-free environment, leading to deeper and more lasting learning.
• Mechanism Teaches, Not the Theme: The core learning happens through the game's rules and underlying frameworks. The Cyber Defense Matrix (CDM) guides strategic investment across the defense lifecycle, while Continuous Threat Exposure Management (CTEM) dictates operational prioritization under live attack.
• Strategic and Operational Alignment is Key: CyberCamp trains board members in portfolio thinking and balanced investment, while Cyber Crisis hones operator teamwork, prioritization, and real-time response. Together, they bridge the cognitive gap, ensuring both sides operate from a shared understanding.
• Prioritization is a Winning Discipline: With limited time and budget, organizations must prioritize defensive actions based on business value and real risk, not just the sheer volume of vulnerabilities.
• Defense in Depth is Crucial: Building multiple layers of defense across the entire Cyber Defense Matrix significantly increases the accumulated catch rate of attacks, proving more effective than relying on a single "strongest wall."

About the Speaker(s)

Yi-Hsien Chen, also known as Eason Chang, is a prominent security researcher and the lead of the AI application team at CyCraft Technology. He is a PhD candidate at National Taiwan University and currently serves as a research fellow at Waseda University in Japan. His research expertise lies in automating malware analysis and enhancing cybersecurity through machine learning, with a recent focus on security aspects of large language models and security applications using LLMs. Chen has published his work in esteemed academic and community conferences, including IEEE TIFS, DSC, HITCON, and COSC. While typically sharing technical research, this talk marks his first time presenting on an educational project.

Chen credits two co-contributors for their work on the CyberCamp and Cyber Crisis programs: Weijia Gao, a senior marketing specialist at CyCraft Japan and director of the Association of Hackers in Taiwan (host of HITCON), and Dengji Lin, a research team lead at CyCraft specializing in artificial intelligence, machine learning, cloud security, and red teaming. Both Gao and Lin are recognized as co-producers of the gamified learning initiatives.