HackCFL Playtest Guide

BREACH

Budget Resource Engagement And Corporate Hacking is a security strategy game about spending limited resources, explaining real attack paths, and surviving pressure from an active attacker team.

Players2+ players: at least one attacker group and one defender group.
Starting ChipsDefenders start with 100 chips. Attackers start with 30 chips.
GoalDefenders win if they still have money after 5 rounds. Attackers win if defenders run out of money before or at the end of the 5th round.

What You Are Learning

BREACH teaches security tradeoffs through play. Defenders feel risk acceptance when they cannot train everything. Attackers explore how a situation can be exploited in more than one way. The core lesson comes from players choosing what to prepare for and accepting what remains exposed.

Game Setup

  1. Split into teams: Attackers and Defenders.
  2. Give chips: Defenders get 100. Attackers get 30.
  3. Build each team: Each side draws 5 character cards from its own character deck, then chooses 3 active characters. The other drawn characters stay in that side’s known pool.
  4. Prepare situation cards: Shuffle the Situation Card deck. Attackers draw 3 Situation Cards.
  5. Prepare item cards: Shuffle attacker and defender item decks separately. Each side may buy item cards using its chips as the rules/card costs allow.
  6. Defender training: Defenders may spend chips to train defense categories. Money left over matters because it increases end-of-round revenue.

Character pool rule: Between rounds, each team may discard used or unused character cards it does not expect to use, then draw back up to 5 total known characters, counting any active characters already in play. Discarded character cards are removed from play.

Round Flow

  1. Setup: Both teams spend chips, buy tools, train, and adjust their character pool if allowed.
  2. Situation: Attackers shuffle and draw 3 Situation Cards, then select one of the drawn cards to use. At the end of the round, that Situation Card is discarded from play.
  3. Attack plan: Attackers choose an attacker and any tools, then explain how they exploit the situation. The explanation must connect to the Situation Type printed on the card.
  4. Defense plan: Defenders choose a defender and any tools, then explain how they respond.
  5. Roll: Both sides roll a d20 and add valid character, training, and item modifiers.
  6. Resolve: Higher roll wins. The winning side explains how the attack worked or failed based on the roll. Apply the margin result, move chips, discard used items, collect defender revenue, and begin the next round.

Attackers

  • Start with 30 chips.
  • Draw 5 attacker characters, choose 3 active attackers.
  • Draw 3 Situation Cards.
  • Spend chips aggressively on tools that help win the current round.
  • On your turn, read the Situation Card aloud.
  • Pick an attacker, pick tools, and explain the exploit.
  • Your exploit must match the card’s Situation Type.
  • Win rolls to steal defender chips and grow your resources.

Defenders

  • Start with 100 chips.
  • Draw 5 defender characters, choose 3 active defenders.
  • Spend chips on training and defensive tools.
  • Keep enough money in reserve: end-of-round revenue is based on remaining chips.
  • After hearing the situation and attack explanation, pick a defender and tools.
  • Explain the defense clearly. It must fit one of the card’s Valid Defense Responses to get the category modifier.
  • Keep money through 5 rounds to win.

Rolling & Resolving

Each side rolls:

d20 + valid category modifier + character modifier + item effects

  • Highest total wins the round.
  • Ties are draw rounds. No chips are awarded or lost, but the company still gains its quarter of remaining money.
  • Use the margin of victory table to decide chip gain or loss.
  • Used item cards are discarded.

Using Situation Cards

Situation Cards are prompts for creative security thinking, not rigid scripts. The attacker should use the card as a real-world scenario and explain a believable way that situation could be exploited. If the explanation clearly connects to the situation and the Situation Type printed on the card, keep the game moving.

Spoken Resolution

After the roll, finish the story out loud. The dice decide the uncertainty; the table explains what happened.

  • If attackers win: explain how the exploit succeeded and what the defenders missed.
  • If defenders win: explain how the response stopped, contained, or exposed the attack.
  • If it is a tie: explain a messy partial outcome. Nobody gains or loses chips, but the company still earns its quarter of remaining money.

BREACH is in active development for HackCFL playtesting. Rules may change between sessions.