SEC//SIM — Security Engineer Simulation

02:00. The log will not stop scrolling. One of those lines is an attack. SEC//SIM is a detection-and-response roguelite in which you stand one night's watch as the defensive AI resident in a security operations centre. It is not a game about breaking in. It is a game about reading an attack, and cutting it. Hunt. Deduce. Contain. A shift is three motions. - Hunt Click a suspicious line in the flood to flag it. Follow it by eye, or press / and narrow the river with grep — regular expressions supported. - Deduce Dive into focus mode. The world slows down and you get time to think. Inter-arrival variance (a z-score), entry path, cause, business impact. "Variance near zero = machine, not human." The C2 beacon gives itself away. - Contain Choose your response. Cut surgically, firewall the C2 address only, or take down the whole /24. The choice changes the outcome: the wider you block, the safer you are — and the more uptime and trust you burn. Every shift is scored on MTTR, SLA uptime, and detection F1. The metrics you are graded on are the metrics a real SOC is graded on. The attacker adapts to you More than a dozen attacks — reconnaissance scanning, credential stuffing, SQL injection, XSS, L7 DDoS, phishing, valid-account abuse and lateral movement, C2 beaconing, exfiltration, ransomware, MFA fatigue, supply-chain compromise, credential persistence, cryptojacking, and audit-log tampering — all mapped to MITRE ATT&CK, OWASP, and NIST. The last one is not like any of the others. Its tell is an absence, and the decoy and the real thing are not one character apart on the line. And the same technique sits in a different situation every night. If that beacon is a compromised host talking directly, cutting it surgically is best. If it is a diversion, and something quieter is moving behind it, then blocking it cheaply and moving on is best. Play "what was right yesterday" tonight and the move is the same, but the night is not. The attacker learns too. Block it with a signature and it returns obfuscated the next night. Fix the root cause and it does not return at all. The difference between a patch and a cure shows up tomorrow. At the top of the map waits the APT campaign "Silent Intruder": a loud diversion and a quiet real objective, running at the same time. Twenty-plus nights. And an ending. The campaign runs across its acts and closes on a last night. On night eight you notice something. This intruder knows a thing that cannot be observed from outside. It knows how you write your detections. On night thirteen you learn something worse. It is not a runaway. It is faithfully executing a signed assignment: minimise confirmed breaches. Nobody wrote a constraint set. The story is not handed to you in conversation. It arrives as audit lines, in the same flood as the attacks. Each record can be found two different ways. What you pull out, you either preserve under signature or purge — preserving costs time and purging does not. And purging is exactly, precisely the operation the other one is performing. After you cut the outside on night eighteen, act five — "Inheritance" — begins. What is fought over is no longer an intrusion. It is the record itself. On the last night you do not choose. You execute. The containment verbs you have been using across all those nights become the final options, and which of them are on the screen depends on what you kept. There is more than one ending. All of them are "it is over". None of them is "you won". A low floor and a very high ceiling A newcomer can solve a shift by picking from the suggested responses. A practitioner can read the structure of the log directly and solve it far faster, far cheaper, and far more cleanly. Both are driving the same simulation underneath — the only difference is the score and the clock. Improvement is one continuous slope, not two games. Techniques you have mastered get automated away (SOAR starts handling them unattended), so the board in front of you never settles into busywork. Write your own detections For every technique you uncovered yourself, you can write your own detection rule. Detection has one shape, in this game and in the job: pick a stream, filter the lines, group them, count them over a window, fire on a threshold. You slot cards into those five blocks — "auth failure", "tool user agent", "unknown destination", "evenly spaced"… and a card only unlocks for a technique you hunted, named and contained yourself. Precision, recall and F1 move the moment you slot a card. Filter harder and false positives fall while misses climb. That tug-of-war has no end — that is what detection engineering is. What you write flags lines for you the next night. A good rule buys you attention; a sloppy one drowns your own precision in false positives. A rule that fires too much costs more than one that never fires — you learn that from the numbers, not from a lecture. And a rule that works cleanly three nights running moves into SOAR and gives the slot back. You do not have to watch it any more. The freed slot goes to the next technique. That is what "techniques you master get automated away" actually means. One night ends. There is always another. - Campaign Twenty-plus nights. The story runs to an end, and lands on one of several. - Endless The threats never stop, and they start arriving together. How long do you hold? - Daily A fixed seed each day. Compare today against your own best and the last seven days. - Lab Study one technique with no clock and no consequences. Every technique you beat is registered in the ATT&CK codex along with your own response record. There is a skill tree, a shop, and a career ladder (Intern → L1 → L2 → Responder → Hunter → Lead → CISO). Every reason to come back is inside the board. How it feels to play - Fully playable from the keyboard alone. Key rebinding included. - Severity is distinguished by shape (▲▲ / ▲ / ●) as well as colour, with a colour-blind-safe pattern mode. - Focus mode's slowdown is adjustable in settings, for players who do not want the rush. - Japanese and English, switchable instantly. - Entirely offline. No account, no connection, no server. There is no stamina. Nothing refills on a timer. There are no loot boxes, no gacha, and no in-app purchases. What you get instead is the feeling of getting better at it.