Zero Day Triage

Rules Overview

Game design: David McDougal

A solo cybersecurity triage game

Players: 1
Time: 10–20 minutes
Ages: 8+
Mechanic: Hand Management / Solo Puzzle

The Situation

It is Monday morning, and on your way into the SOC, a zero-day exploit hits the network.

Today is going to be a triage battle.

Can you keep the infection at bay, patch compromised systems, and bring the incident under control before the end of your eight-hour shift?

Or will you have to hand the mess you inherited off to the next technician?

Each round represents roughly one hour of your shift.

Components

Use one standard deck of cards.

Hearts are not used.

Infection Deck

Use all Diamonds:

• ♦2–♦10
• ♦J, ♦Q, ♦K
• ♦A

Card values are their printed value:

• J = 11
• Q = 12
• K = 13

♦A is Mitigation and is not an infection.

Response Deck

Use all Spades and Clubs:

• ♠2–♠10, ♠J, ♠Q, ♠K, ♠A
• ♣2–♣10, ♣J, ♣Q, ♣K, ♣A

J = 11, Q = 12, K = 13.

♠A and ♣A are Surges and never enter your hand.

Setup

1. Shuffle the Infection Deck and place it face down.
2. Shuffle the Response Deck and place it face down.
3. Leave room for a discard pile beside each deck.
4. Leave room for a separate Cleared pile.
5. The Threat Row begins at 4 cards.
6. Draw until you have 5 Patch cards in hand.

If you draw ♠A or ♣A while drawing your starting hand, resolve the Surge immediately and keep drawing until you have 5 Patch cards.

Your Shift

Play 8 rounds.

Each round represents about one hour of incident response.

Each hour has three steps:

1. Infection
2. Patch
3. Cleanup

1. Infection

Fill the Threat Row to its current size.

Normally the Threat Row holds 4 infections.

If a Surge is active, it holds 5.

Any infections left from the previous hour stay in the row and count toward that total.

♦A — Mitigation

When ♦A is revealed:

• return the Threat Row to 4 cards;
• remove the active Surge marker, if there is one;
• remove ♦A from the game;
• continue filling the Threat Row if needed.

♦A never enters the Threat Row.

If the row is already at 4, simply remove ♦A and continue.

2. Patch

Play Patch cards from your hand onto infections in the Threat Row.

A Patch clears an infection if:

Patch value ≥ Infection value

Examples:

• ♣6 clears ♦4.
• ♠9 clears ♦9.
• ♣Q clears ♦J.
• ♠K clears any infection.

Each Patch may target only one infection.

Each infection may receive only one Patch.

You may patch as many infections as you are able, or leave some unresolved.

3. Cleanup

Discard every successfully patched infection to the Infection discard pile.

Discard its Patch card to the Response discard pile.

Any infection you did not clear remains in the Threat Row for the next hour.

Perfect Hour

If you clear the entire Threat Row during an hour, you earned some breathing room.

Before the next hour begins, you may move up to 2 cards from the top of the Infection Deck face down into the Cleared pile.

Do not look at them.

Cards in the Cleared pile are removed for the rest of the game.

You may remove:

• 0 cards,
• 1 card,
• or 2 cards.

Your choice.

Refill Your Hand

Draw from the Response Deck until you have 5 Patch cards again.

If you draw ♠A or ♣A, resolve the Surge immediately.

♠A / ♣A — Surge

When you draw a black Ace:

• place the first black Ace face up beside the Threat Row;
• the Threat Row now holds 5 infections;
• immediately fill the new fifth slot if you are currently resolving the Infection step;
• draw another Response card.

The face-up Ace is your reminder that the Threat Row is currently 5 cards.

If another black Ace is drawn while a Surge is already active:

• discard the newly drawn Ace;
• draw another card;
• the Threat Row stays at 5.

When ♦A Mitigation is revealed, discard the face-up Surge Ace to the Response discard pile and return the Threat Row to 4.

Black Aces may return later if the Response discard pile is reshuffled.

Reshuffling

When the Infection Deck runs out, shuffle the Infection discard pile to make a new Infection Deck.

When the Response Deck runs out, shuffle the Response discard pile to make a new Response Deck.

Cards in the Cleared pile never return.

♦A Mitigation never returns after it resolves.

End of Shift

After Hour 8, finish your Patch and Cleanup steps.

Do not refill the Threat Row.

Count the infections still remaining.

How Did Your Shift Go?

0 — Fully Contained: You Deserve a Raise!

1 — Edge Case Remains: Good Enough for Production!

2 — Patching Effective: If Only the Devs Had Gotten It to You Sooner!

3 — Still Active: Did the Devs Cowboy Code This Patch?

4 — Exploit Still Active: Did You Take a Long Lunch?

5+ — Overtime May Be Required: Better Let Someone Know.

Your goal is simple:

Leave as little work as possible for the next technician.

Quick Example

The Threat Row contains:

• ♦4
• ♦8
• ♦J
• ♦K

Your hand contains:

• ♠5
• ♣8
• ♠10
• ♣Q
• ♠K

You play:

• ♠5 on ♦4
• ♣8 on ♦8
• ♣Q on ♦J
• ♠K on ♦K

All four infections are cleared.

That gives you a Perfect Hour.

Before the next hour begins, you may move up to two cards from the top of the Infection Deck face down into the Cleared pile.

Then refill your hand and continue your shift.

Quick Rules

• Diamonds are infections.
• Spades and Clubs are patches.
• J = 11, Q = 12, K = 13.
• Patch equal to or higher than the infection.
• Threat Row starts at 4.
• Black Ace = Surge to 5.
• ♦A = Mitigation back to 4.
• Clear the entire row = Perfect Hour.
• Perfect Hour may clear up to 2 unseen Infection cards.
• Play 8 hours.
• Count what is left.

Frequently Asked Questions