Introducing Resource Management Into a Large-Scale Cyber Security Seminar Game: A Case Study

This paper presents the design, development, and preliminary evaluation of a resource management component added to a traditional seminar-style cybersecurity wargame. The author sets out to address long-standing criticisms of seminar games, namely their pre-scripted outcomes, limited player agency, idealized solutions, and disregard for practical constraints such as limited resources. The game was built through a participatory design process involving cybersecurity policy experts, a returning player, and a platform designer, going through eight iterations and multiple playtests before deployment. Its core mechanics include a limited pool of teams, project cards that persist across turns, a four-turn timeline, and mandatory projects that must be staffed regardless of player preference.

The game was deployed during Locked Shields, a large-scale international cybersecurity exercise with over 1,500 participants, where governmental representatives from 18 countries played in a hybrid analogue-digital format administered by white team liaisons. Data was collected through observations during play, informal and semi-structured interviews, and a post-game debrief. Eighteen of nineteen liaisons engaged with the resource component, and two distinct play styles emerged, a conservative approach that holds reserves and an aggressive approach that keeps teams continuously deployed. Industry-affiliated teams tended toward aggressive play, while teams with military involvement were more conservative.

Participants reported high engagement, with one team spending nearly as much time debating resource allocation as strategic questions, and several liaisons describing a flow-like experience. Notable criticisms included the absence of consequences or a fail state, concerns about the realism of banking-sector projects, and the linear structure of the inject deck, which prompted calls for branching narratives and virtualized boards. The author characterizes the work as a proof of concept, notes that quantitative trace data remains to be analyzed, and reports growing stakeholder interest in adopting the method for further training.