BREACH Rules Reference
Attack & Defense Categories
Use this page to match attacker categories to the defender categories that usually answer them. Situation Cards are still the final authority for valid defenses during a round.
Attack & Defense Categories
Before play starts, use this guide to understand what kind of defender category usually answers each attacker category. Situation Cards still decide the valid defense responses for that round, but this gives new players a quick map of the card language.
| Attacker category | Defender category |
|---|---|
| PhishingTricks people into clicking links, opening files, or giving up information through fake emails or messages. | Security Awareness TrainingDefends by helping people recognize suspicious messages, slow down, report them, and avoid taking the bait. |
| Vishing & PretextingUses phone calls, texts, or a believable story to pressure someone into trusting the attacker. | Verification ProceduresDefends by requiring a second check, approved process, or trusted channel before sharing access or information. |
| Insider ThreatAbuses legitimate access from an employee, contractor, or trusted person who can already reach internal systems. | Behavior MonitoringDefends by spotting unusual activity, risky access patterns, policy violations, or suspicious data movement. |
| Exploiting VulnerabilitiesTakes advantage of unpatched software, weak configurations, exposed services, or known technical flaws. | Patch ManagementDefends by fixing known weaknesses, updating systems, removing risky exposure, and keeping software current. |
| Malware DeploymentInstalls or runs malicious software such as ransomware, spyware, trojans, or destructive tools. | Endpoint ProtectionDefends by blocking, detecting, isolating, or removing malicious activity on laptops, servers, and devices. |
| Intercepting Network TrafficCaptures, redirects, or watches data moving across a network to steal information or manipulate communication. | Network SecurityDefends by segmenting networks, encrypting traffic, monitoring connections, and blocking unsafe paths. |
| Supply Chain AttacksCompromises a vendor, tool, update, partner, or outside service the organization depends on. | Vendor ManagementDefends by reviewing third-party risk, limiting vendor access, setting requirements, and monitoring dependencies. |
| Credential AttacksTargets passwords, tokens, accounts, or login processes through guessing, reuse, theft, or bypass attempts. | Password PolicyDefends by requiring stronger authentication, safer password practices, account controls, and reduced credential reuse. |
| PersistenceKeeps access after the first breach by hiding accounts, backdoors, scheduled tasks, or other footholds. | Threat HuntingDefends by actively searching for hidden access, suspicious behavior, and signs the attacker is still inside. |
How to use this: match the Situation Type and the story being told. A tool or character bonus should only count when the table agrees it clearly fits the current situation.