BC BreachCity Play free

INC-2026-049 · open · clock held

Run the company.
Survive the breach.

BreachCity is a security simulation where every decision has a price. Isolate the storefront and you stop the attacker — and the sales. Learn incident response the way it actually feels.

6 organisations · 1 city · 0 safe days
09:14:02 DMZ web-01 POST /search?q=' OR 1=1-- → 500 09:14:07 SIEM correlation: SQLi → db-02 outbound 443 09:15:40 EDR crane-plc-3 unsigned binary executed 09:16:11 MAIL fin-07 opened 'Invoice_Q3_overdue.html' 09:17:58 IDS AIS feed: 4 vessels at identical coordinates 09:18:30 IAM svc-ci token used from new ASN 09:19:02 GDPR 72h disclosure clock started 09:14:02 DMZ web-01 POST /search?q=' OR 1=1-- → 500 09:14:07 SIEM correlation: SQLi → db-02 outbound 443 09:15:40 EDR crane-plc-3 unsigned binary executed 09:16:11 MAIL fin-07 opened 'Invoice_Q3_overdue.html' 09:17:58 IDS AIS feed: 4 vessels at identical coordinates 09:18:30 IAM svc-ci token used from new ASN 09:19:02 GDPR 72h disclosure clock started

Six organisations.
Six ways to lose.

Each runs its own economy, network and threat model. Downtime hits revenue, fines hit cash, and nobody sends a warning.

    One shift, three beats.

    01

    Run the business

    Bid on contracts, hire staff, buy tools. Security spend competes with everything else on the budget.

    02

    An incident lands

    The clock stops. Read the evidence, flag what matters, pick a playbook. Containment has a cost in uptime and cash.

    03

    File the debrief

    An after-action report scores your call against ground truth: what you caught, what you missed, what it cost.

    Try the triage console.

    This is how incidents play. Click the log lines you think are part of the attack. The game grades precision and recall — flagging everything isn't a strategy.

    Caught
    0/3
    False flags
    0
    TRIAGE · INC-2026-049 · Fernway storefront GDPR 71:59:00
      1 · Isolate DMZ 2 · Block egress 3 · Patch & monitor Enter to commit_

      Built to train teams, not to impress them.

      No live fire
      No real phishing email, no credential capture, no offensive tooling. Everything happens inside the sim.
      Replayable
      Seeded and deterministic. Run the same scenario twice and compare what changed.
      Mapped
      Scenarios tagged to MITRE ATT&CK, with GDPR, NIS2 and DORA duties built into the clock.