Breach City Play free

BREACH IN PROGRESS · INC-2026-049DECIDE IN 04:59

Run the company.
Survive the breach.

Breach City is a security simulation where every decision has a price. Isolate the storefront and you stop the attacker, and the sales. Learn incident response the way it actually feels.

Halcyon Labs' campus in San Francisco: the GPU cluster, CI/CD, the security operations centre and painted Victorian streets, as they appear in the game
Available funds$1.50MDay 11
6 organisations · 6 cities · 0 safe days
09:14:02 DMZ web-01 POST /search?q=' OR 1=1-- → 500 09:14:07 SIEM correlation: SQLi → db-02 outbound 443 09:15:40 EDR crane-plc-3 unsigned binary executed 09:16:11 MAIL fin-07 opened 'Invoice_Q3_overdue.html' 09:17:58 IDS AIS feed: 4 vessels at identical coordinates 09:18:30 IAM svc-ci token used from new ASN 09:19:02 GDPR 72h disclosure clock started 09:14:02 DMZ web-01 POST /search?q=' OR 1=1-- → 500 09:14:07 SIEM correlation: SQLi → db-02 outbound 443 09:15:40 EDR crane-plc-3 unsigned binary executed 09:16:11 MAIL fin-07 opened 'Invoice_Q3_overdue.html' 09:17:58 IDS AIS feed: 4 vessels at identical coordinates 09:18:30 IAM svc-ci token used from new ASN 09:19:02 GDPR 72h disclosure clock started

Six organisations.
Six ways to lose.

Each runs its own economy, network and threat model, in a real city. Downtime hits revenue, fines hit cash, and nobody sends a warning.

    One shift, three beats.

    Step 01 · Business

    Run the business

    Bid on contracts, hire staff, buy tools. Security spend competes with everything else on the budget.

    Step 02 · Incident

    An incident lands

    The clock stops. Read the evidence, flag what matters, pick a playbook. Containment has a cost in uptime and cash.

    Step 03 · Debrief

    File the debrief

    An after-action report scores your call against ground truth: what you caught, what you missed, what it cost.

    Try the triage console.

    This is how incidents play. Click the log lines you think are part of the attack. The game grades precision and recall, so flagging everything isn't a strategy.

    Caught0/3
    False flags0
    TRIAGE · INC-2026-049 · Harbor Port booking portal GDPR 71:59:00
      1 · Isolate DMZStops it. Stops the sales too.
      2 · Block egressCuts the data leaving.
      3 · Patch & monitorSlow, and the attacker stays.

      Pick a card, then deploy. The clock holds while you decide.

      Built to train teams, not to impress them.

      Run it for your team
      No live fire
      No real phishing email, no credential capture, no offensive tooling. Everything happens inside the sim.
      Replayable
      Seeded and deterministic. Run the same scenario twice and compare what changed.
      Mapped
      Scenarios tagged to MITRE ATT&CK, with GDPR, NIS2 and DORA duties built into the clock.