🛡️ Cyber Response Lab
A real incident lands every round. Students choose the right security tools, put them in the right order and learn the science that makes each one work.
What students do
Each incident arrives with a short story and live alerts. The response plan has four or five steps, each tagged with its stage in the NIST Cybersecurity Framework. Students pick one tool from the table for every step. The right tool in the right step scores. A right tool in the wrong step scores a little. A tool that makes things worse, or steps done in an unsafe order (restoring before isolating, resetting before checking), costs points. After each round the reveal explains every step, so the science sticks.
Four ways to play
Start with the solo lab to learn the tools, then run the live class version with the whole room on their phones.
Solo lab
Any time, no code. 10 incidents, Beginner or Advanced, drag-and-drop tools, a Science tab with live demos (hashing, MFA codes, firewall rules, anomaly scores) and a logbook you can export.
Open the solo lab →Live · Team
Students scan the QR code and join a team. Each team agrees one response plan; the Lead submits it. Best for discussion.
Join with a code →Live · Individual
Everyone scans the same QR code and runs their own response team of one. Best for assessment and large lecture halls.
Join with a code →Live · Hybrid
Everyone decides on their own phone, and their team's score is the average of its members. Individual effort, team result.
Join with a code →Students: join in 30 seconds
This code opens the game page. In class, scan the code on the big screen instead: it takes you straight into your room.
- Scan the QR code on the big screen with your phone camera, or open games.inlabsgroup.com/cyber-response and type the 4-letter code.
- Type your first name. No app, no account.
- Team or hybrid mode: join a team or create one and name it. You get a role. Individual mode: you are your own team.
- If your phone locks or the page reloads, open it again: you return to the same seat.
Students: each round
- Read the incident and the live alerts. Every alert is a clue.
- Open the tool cards: what each tool does and the idea behind it.
- Choose one tool for every step of the response plan, in order.
- Choose who to tell, and when.
- Predict your score, then submit (in team mode the Lead submits).
- Watch the reveal: a tick, ↔ or cross for each step, with the reason.
Team roles
- Lead
- Reads the alerts aloud, makes the final call on each step and submits. Any teammate can take over if the Lead's phone dies.
- Analyst
- Says which NIST stage each step belongs to and owns the team's prediction.
- Toolkeeper
- Checks each tool's job card before it goes into a step.
- Risk officer
- Watches the order: nothing is restored or reset before it is safe.
- Voice
- Owns the communication choice and explains the plan at the debrief.
The four live rounds
About 7 minutes a round. An event card can land between rounds. The facilitator can run up to 10 rounds, one incident each.
- 1
The fake invoice link
A bank: three staff typed their passwords into a fake login page and one account was used from a new country.
Watch for: blocking an IP address instead of the domain; adding MFA before resetting stolen passwords.
- 2
Thousands of failed VPN logins
A university: password spraying across 600 accounts, and two logins succeeded.
Watch for: resetting passwords before checking what the two accounts did.
- 3
Files turning into .locked
A logistics firm: ransomware is encrypting the shared drive from one finance laptop.
Watch for: restoring backups before isolating the laptop.
- 4
Salary file shared with “anyone”
A retailer: a salary spreadsheet has a public cloud link that has been opened 57 times.
Watch for: network tools for a problem that lives in the cloud.
How you are scored
Leaderboard score = 100 × (0.5 × performance + 0.25 × resilience + 0.25 × trust) + up to 10 prediction points a round. The facilitator can change the weights before the game starts.
Event cards
- The attacker comes back. Sequence mistakes cost 15 instead of 10.
- 72-hour breach-notice rule. Waiting or keeping quiet costs far more trust.
- The board is watching. Trust gains and losses are 50% bigger.
- Alert fatigue. Harmful tools cost 12 instead of 8.
For facilitators 4 rounds · about 45 minutes
Facilitator access
- On the projector laptop, open games.inlabsgroup.com/cyber-response/?host or press Run it as facilitator above.
- Enter the facilitator PIN. Ask your Playbook administrator if you do not have it; never share it with students.
- Open Setup: choose Team, Individual or Hybrid, how students get into teams, team size, rounds and minutes per round.
- Press Q to show the big join QR code. Students scan it and appear in People.
- Press Start. Bots fill empty seats if you like, and students can still join late.
Joining with the QR code
- As a team
- Team mode: students scan, then pick a team or create one. One decision per team, submitted by the Lead. Choose Automatic in Setup to fill one team, then the next.
- Alone
- Individual mode: every student runs their own response team. Ideal for assessment.
- Hybrid
- Hybrid mode: students join a team but each decides on their own phone; the team score is the average of its members.
- Late or lost phone
- Scanning again returns a student to the same seat. Lock joining once everyone is in.
Run sheet
| Before class | Students try the solo lab's Science tab. Open the console on the projector and check the QR code. |
|---|---|
| 0–5 min | Students scan and join. Show the six NIST stages. |
| 5–35 min | Four rounds: about 7 minutes to decide, then Reveal. Read the headline and the step-by-step table. |
| Between rounds | Draw, choose or write an event card. Give teams 30 seconds to read it. |
| Last 10 min | Final results, debrief questions, reflections on phones. Download the CSV. |
Every facilitator control
The console has four tabs: Run, People, Setup and Data. Shortcuts: P projector mode, Q join QR.
Run the round
- Start, with or without players
- Reveal now (missing decisions are filled automatically)
- Pause, resume or set the time left
- Step back a screen, undo an event or reopen a round
- See who has submitted, live
Event cards
- Draw a random event
- Draw another or choose one
- No event this round
- Write your own headline and text
Projector and screens
- Projector mode and full screen
- Big join QR code
- Message every screen, or quick messages: 2 minutes left, short break, eyes on the screen
- Freeze the projector while you talk
- Show how to play on the projector
Leaderboard
- Show or hide the leaderboard
- Hide names (anonymise)
- Spotlight one team's decision and result
- Final results: podium and score chart
People and teams
- Lock or unlock joining
- Add a team or a computer player (bot)
- Move players, make a Lead, rename, remove
- Award or fine points with a reason shown on phones
- Fill missing parts with the computer
Setup and data
- Play mode: Team, Individual or Hybrid
- Students choose teams or automatic; team size; number of teams
- Rounds, minutes per round, fill with bots
- Score weights for performance, resilience and trust
- New game (keep players), rerun the same seed, fresh start with a new code
- Download CSV of decisions, results and reflections; session log
Debrief questions
- Which step did your team find hardest, and which alert should have told you the answer?
- Why does containment come before recovery? Give an example from the game.
- Pick one tool you used and explain the science that makes it work.
Reflection and evidence
In 80–120 words, students describe one incident, the tools they used in order and the science behind the most important one. The Data tab exports every decision, result, prediction and reflection as one CSV for grading.