Rémi Couture · Cyber training games

Gamified cyber training · designed and built by Rémi Couture

Cyber training your learners actually finish.

I design and build training games for cyber ranges and security training platforms. Here are eight, playable right now, with real content and a tested rule behind every lesson. Play them, then picture your own curriculum working this way.

▶ Watch and play the gamesTalk about your platform ↗Three-minute reel ↓
8games, each playable from briefing to debrief
209automated tests, all passing, on the learning rules
8genres: strategy, inbox, triage, puzzle, SOC case, dispatch, SQL, arcade
0servers or labs to run. Each game is a static page

All eight, in motion

Pick a game. Every clip is real play.

Each one shows a decision, a mistake, the game’s own explanation, and the fix. Click a tile for the full write-up and a playable build.

Network DefenseIsometric strategyPhishing Speed DrillTimed inbox drillIncident Triage RaceAlert triage boardSOC Dashboard ChallengeSOC investigation caseCyber DispatchDispatcher deskQuery HuntSQL investigationCloud CommandArcade flightPrivilege Path PuzzleAccess graph puzzle

Three minutes

The whole line-up in one reel.

Watch for three things in each game: the learner makes a real decision with real content, the game explains a mistake in one or two specific sentences, and the learner fixes it and sees the result change.

The games, one by one

Real content, quoted from the games.

Nothing here is placeholder. Every quote below is on screen in the build you can play.

Runs in your browser · sample content
Network Defense: Keep Finance Online debrief screen
The debrief explains the result and replays the learner’s decisions.

Game 1 of 8 · Isometric strategy

Network Defense: Keep Finance Online

Teaches: How routes and dependencies keep a service up, how to read evidence, and how to write an access rule that stops the attacker without stopping the business.

Evidence on screen“Source 198.51.100.23 is not on any approved list and is outside the company network.” “Destination: Finance — Remote desktop admin (RDP 3389).” “Pattern: repeated sign-in attempts, each with a different username.”
After a common mistake“You connected Finance straight to the Gateway. Invoices reached Finance, but Finance couldn’t reach its database on the Core server, so each one failed. Services depend on other services — a path from the internet isn’t enough.”
Final challenge, no hints“Which single rule best fits the policy?” Answer: DENY 203.0.113.200 → HR : Admin console
How it is scored
40% service delivered, 40% prohibited activity denied, 20% efficiency. Two reasoning checkpoints and the final challenge are recorded separately as learning evidence.
Proved by tests
“Blanket blocking cannot earn the best result” and “backup routes preserve the access policy”, each checked on 8 seeds. 32 tests.
Depth and replay
A new seed changes the traffic order, the attacker’s address and service, and which link fails.
Why it sticks
The learner watches a rule succeed or fail on live traffic, so cause and effect are remembered together. Firewall and access rules, taught through consequences.
Runs in your browser · sample content
Phishing Speed Drill: The Payroll Request debrief screen
The debrief explains the result and replays the learner’s decisions.

Game 2 of 8 · Timed inbox drill

Phishing Speed Drill: The Payroll Request

Teaches: Reading the sender, the reply-to and the real link destination, backing a call with evidence, and knowing when only a phone check can settle it.

A look-alike domainhelpdesk@acme.example.it-notices.example “A domain is read from the right. This address belongs to it-notices.example; ‘acme.example’ is only a label in front of it.”
A genuine address, still not safeA bank-change request from a real colleague’s address: “The address is genuine, but a matching address doesn’t prove who is typing. Mailboxes get compromised.”
After a false alarm“This was a real payslip notice. External mail and a generic greeting are not evidence by themselves; the domain, link, and timing all matched. False alarms slow down real work.”
How it is scored
100 for the best response, +20 per strong cue cited, a streak bonus, and a speed bonus that only counts after a correct decision. A false alarm scores zero.
Proved by tests
Always-report, always-safe and always-verify each “stay out of the top two ratings”. “Slow but correct play still earns the top rating.” 53 tests.
Depth and replay
8 messages, 32 cues. The first message is guided and untimed; later batches are shuffled per seed.
Why it sticks
Citing the evidence before deciding builds the habit of looking, not guessing. Awareness training for every employee, not only analysts.
Runs in your browser · sample content
Incident Triage Race: The Busy Morning debrief screen
The debrief explains the result and replays the learner’s decisions.

Game 3 of 8 · Alert triage board

Incident Triage Race: The Busy Morning

Teaches: Setting priority from evidence and business impact, linking alerts that are one incident, and revising when new facts arrive.

Tagged “Low” in the queueA new device on an account that “approves outgoing payments”. “The quietest alert in the queue turns out to be an attacker with a working sign-in on the payments portal. Business impact, not the severity tag, sets the urgency.”
A mid-shift update“Infrastructure confirms change ticket CHG-4471: backups moved to a new offsite storage provider this morning… Nothing else in the queue is explained by it.”
A justification that always scores zero“The severity tag says so.”
How it is scored
Points for the best or a defensible lane, a matching reason, revising on new evidence and correct links. Missed criticals and needless escalations cost points. Time is reported separately.
Proved by tests
“Never treats the severity tag as a valid justification.” “Rewards revising when evidence changes, not standing still.” 13 tests.
Depth and replay
6 alerts, 29 evidence items, 2 updates over 3 rounds, with a 7-moment replay in the debrief.
Why it sticks
Being wrong about the quiet alert, then seeing why, is the lesson people repeat to colleagues. A natural team game for workshops and live events.
Runs in your browser · sample content
SOC Dashboard Challenge: A Strange Login debrief screen
The debrief explains the result and replays the learner’s decisions.

Game 4 of 8 · SOC investigation case

SOC Dashboard Challenge: A Strange Login

Teaches: Separating evidence that discriminates between explanations from evidence that fits both, and responding in proportion while data is leaving.

Same opening, two possible truthsCompromise: “OUTLOOK.EXE → WINWORD.EXE (Invoice_Q3_revised.docm) → powershell.exe -WindowStyle Hidden -EncodedCommand …” Approved work: “Task Scheduler → powershell.exe -File QuarterClose-Export.ps1”.
Evidence that proves nothing“A passed prompt shows that someone tapped Approve. Intruders get prompts approved too, so this fits both explanations.”
After over-reacting“You had strong evidence that this was approved work and contained anyway. The business paid for an interruption the evidence did not support.”
How it is scored
Outcome 40, decisions 36, reasoning 24. “Each call is judged on what you knew at the time, not on how the case turned out.”
Proved by tests
“No single blind opening wins in both variants.” “Investigating first is not always right: delay lets the incident progress.” 13 tests.
Depth and replay
The seed decides whether it is a compromise or approved work. Practice mode can rewind to any decision.
Why it sticks
Two truths with the same opening teach that the right call comes from evidence, not from matching a familiar story. A warm-up before a hands-on investigation lab.
Runs in your browser · sample content
Cyber Dispatch: First Shift debrief screen
The debrief explains the result and replays the learner’s decisions.

Game 5 of 8 · Dispatcher desk

Cyber Dispatch: First Shift

Teaches: Asking the questions that matter, giving the safe next step before harm lands, and handing off only what the evidence confirms.

A report comes in“Hi! I just got an MFA prompt but I’m not signing in right now. I’m at my desk. Is this legit?” Asking reveals: “The prompt shows a Mail sign-in from Rotterdam. She is in the Lisbon office.”
The safe step, in time“Turn off Wi-Fi and unplug the network cable now. Leave the laptop switched on.”
A harmful step and its consequence“Reply to the email and ask them to confirm the new details.” → “The sender ‘confirmed’ their own request, and Elena queued the payment.”
How it is scored
Four parts of 25 per report: evidence gathered, priority, guidance and handoff. Response time is shown but kept out of the score.
Proved by tests
“Escalating everything as high scores poorly.” “Asking every question before acting is not the best run.” 24 tests.
Depth and replay
6 reports over 2 shifts, 38 questions, 24 guidance options. The second shift changes which report is benign.
Why it sticks
Recoverable harm: the learner sees the damage a bad instruction causes, then gets to put it right. First response and handoff, for help desks and non-specialists.
Runs in your browser · sample content
Query Hunt: Unusual Access debrief screen
The debrief explains the result and replays the learner’s decisions.

Game 6 of 8 · SQL investigation

Query Hunt: Unusual Access

Teaches: Filtering, aggregating and joining real log tables, reading the result correctly, and telling a suspicious observation from a confirmed conclusion.

A query the learner producesSELECT account_id, COUNT(*) AS attempts FROM logins WHERE result = 'failure' … GROUP BY account_id ORDER BY attempts DESC
When the learner jumps ahead“Repeated failed logins alone do not establish compromise: they show attempts. Which evidence shows what happened after them?”
The debrief names the limits“The records do not show who was at the keyboard, how the password was obtained, or that data left the device.”
How it is scored
Out of 1,000: correct results, evidence cards, interpretation and conclusion. A right conclusion without its evidence scores zero. Hints are counted, never deducted.
Proved by tests
“Accepts equivalent queries written differently.” “Never grants evidence for running a query.” Real SQLite runs in the tests. 31 tests.
Depth and replay
A second dataset makes the highest failure count the wrong account to follow. Guided tiles or written SQL.
Why it sticks
Writing the query is retrieval practice. Being stopped from over-claiming teaches analytic discipline. Log analysis practice with real SQL in the browser.
Runs in your browser · sample content
Cloud Command: First Orbit debrief screen
The debrief explains the result and replays the learner’s decisions.

Game 7 of 8 · Arcade flight

Cloud Command: First Orbit

Teaches: Finding the real capacity constraint through a dependency, balancing availability against cost, least privilege, and who is responsible for what on IaaS.

Requirements“Serve at least 99% of checkout requests at the peak.” “Keep 10% headroom above the expected peak on every service in the request path.” “Cost ceiling: 120 credits for the 2-hour surge window.”
After scaling the wrong serviceCheckout “has enough capacity, but each request calls” the Payments API, “which can serve only” 1,200 rps. More checkout instances “cannot help until” it has capacity.
Least privilegeA backup account holds 7 permissions. “Reading a snapshot requires keys:use on that key. The ticket does not mention it.”
How it is scored
Continuity 35%, policy 30%, resources 15%, justification 20%. A failed access review marks the security objective failed whatever the score.
Proved by tests
“Adding capacity helps only where capacity is the constraint.” “Does not let a high score hide a failed security objective.” 18 tests.
Depth and replay
3 checkpoints, 11 evidence items. Fly manually or on autopilot; flying is reported apart from the learning score.
Why it sticks
The numbers in the feedback come from the simulation, so the explanation matches exactly what the learner did. Cloud fundamentals in a lighter, arcade style.
Runs in your browser · sample content
Privilege Path Puzzle: Who Can Read Payroll debrief screen
The debrief explains the result and replays the learner’s decisions.

Game 8 of 8 · Access graph puzzle

Privilege Path Puzzle: Who Can Read Payroll

Teaches: Tracing nested groups and inherited grants to find every route to a file, then making the smallest change that closes it without breaking business access.

The brief“An engineer opened a payroll file. Nobody remembers giving them access.” Hidden in the graph: “Added during a payroll deadline two years ago so Finance could get in quickly.”
A check the fix must still pass“svc-backup · Write · Ledger — must be denied”: “A backup job copies data. It never needs to change it.”
After a wrong explanation“Signing in is authentication: it proves who Alex is. What Alex may open is authorization, and that came from a grant.”
How it is scored
100 for solving, a bonus for matching the minimum number of changes, points for correct predictions, and 40 for explaining it right first time.
Proved by tests
“Never treats connectivity as authorization.” Each puzzle “cannot be solved with fewer changes than par” and “fails when access is removed for everyone”. 25 tests.
Depth and replay
3 puzzles, 22 nodes, 13 access checks. Inspect, predict, test, change, verify, explain.
Why it sticks
Predict, test, then explain: the learner commits to an answer before seeing the result. Identity and access reasoning as a visual puzzle.

Why people remember it

Built on how people learn, not on points and badges.

Most “gamified” training is a quiz with a score on top. These start from the skill and make the skill the only way to play.

Retrieval practice

The learner produces the answer

They write the SQL, build the rule, place the alert, choose the fix. Producing an answer builds memory that reading and recognising do not.

Immediate, specific feedback

Every mistake explains itself

Feedback names the decision and the reason at the moment it happens, in one or two plain sentences.

Safe failure

Consequences without damage

A wrong call queues a fraudulent payment or cuts off a working laptop, in fiction. The learner sees the cost, then gets to fix it.

Judgment over recall

Evidence before conclusion

Inspecting never classifies for you. Weak evidence never counts as proof. A right conclusion without its evidence scores zero.

Reflection

A debrief that replays your decisions

Choice, observed result, and why. One game rebuilds the exact moment from the learner’s own command log.

Short and repeatable

Five minutes, different next time

Seeds and variants change the traffic, the attacker, or which report is harmless, so a replay is practice and not memorisation.

Twenty years of game craft, applied to training

The hard part is balance. I test it like a game studio.

If a learner can win by doing the same thing every time, the game teaches that habit. So every game has tests that prove the lazy strategy loses.

The first ten seconds

A guided first step in each game. The learner acts before they read a manual.

An economy of trade-offs

Action points, analyst slots, credits and minutes are limited. Limits turn knowledge into decisions.

Lazy strategyWhat the tests prove
Block everything“Blanket blocking cannot earn the best result”, checked on 8 seeds
Report every emailAlways-report, always-safe and always-verify each “stay out of the top two ratings”
Escalate everything“Penalizes escalating everything alarming” and “penalizes monitoring everything”
Trust the label“Never treats the severity tag as a valid justification”
Always investigate first“Investigating first is not always right: delay lets the incident progress”
Go fast“Slow but correct play still earns the top rating”

Built like a product, not a demo

Made to be reviewed, tested, embedded and extended.

About 22,000 lines of TypeScript including tests. I design and direct, and build with AI-assisted tooling, which is how one person ships this much.

Content in one file per game

Scenarios, evidence, policy and explanations sit apart from the code, so your subject experts can review and change the teaching without touching the engine.

Rules that run without a browser

Each simulation is pure logic, separate from the screen. That is why 209 tests can check the learning rules in under two seconds.

Deterministic and replayable

The same seed and the same commands always give the same result. It powers the debrief replays and allows server-side verification.

Drops into your platform

Each game is a static page that posts started, statement and completed events to its host, with an activity ID per scenario. No backend, no sign-in.

Expert review packs

A review sheet lists every objective, simplification and explanation for your experts to approve, correct or reject.

Accessible by design

Keyboard play, focus-managed dialogs, screen-reader announcements, reduced-motion and larger-text settings. Status never relies on colour alone.

What it does for a training business

The cheapest way to add practice, reach and proof.

I have not measured learner outcomes on these yet and I am not quoting numbers. The first thing I do with a client is put games in front of real learners and measure.

Practice that costs nothing to run

A hands-on lab needs live machines. A game is a static page. Learners can practise as often as they like.

A demo that runs anywhere

No sign-in and no install. A prospect can play a round in a meeting, at a booth, or from a link in an email.

More for every licence

New games widen your catalog between major releases and give customer admins something fresh to assign.

Made for workshops and events

Short, scored, easy to watch. They suit live sessions where dozens of people play at once from a browser.

Evidence for reporting

Decisions and reasoning are recorded apart from the score, so readiness reporting gets more than a completion tick.

Mapped to your frameworks

Scenarios are data, so each can be tagged to NICE work roles, MITRE ATT&CK or your own skills model, and localised.

More games, in any style

Eight genres so far. The method is what scales.

  • Start from the skill. One learning objective, one decision learners keep getting wrong.
  • Find the mechanic that is the skill. If you can win without the knowledge, it is the wrong mechanic.
  • Write the content as data. Scenario, evidence, and an explanation for each mistake, in one reviewable file.
  • Prove the balance. Tests that show lazy strategies lose and careful play wins.
  • Hand your expert a review sheet. Every objective and simplification, ready to approve or correct.
What I could build for youWhy
Incident response sequencerOrder the response steps under pressure, then defend the order.
Framework sortersRoute events to NIST CSF functions, or techniques to ATT&CK tactics.
New cases for these eightNew scenarios are content, not code: a second inbox, a harder shift, a new dataset.
Team modes for live eventsHead-to-head triage and dispatch with a shared leaderboard.
Lab warm-upsA two-minute game before a hands-on lab that drills the one concept it depends on.
Your curriculum, your lookThe same method in your visual style, on your content.

Work with me

Three ways to start.

Fixed scope, a clear end point, and you own what you pay for.

Start here

One game, built for you

Fixed scope and fee

Give me one skill your learners keep failing. You get a playable game on your content.

  • Concept and mechanic, agreed before I build
  • Authored scenario with an explanation for every mistake
  • Test suite that proves the balance
  • Review sheet for your subject experts
  • Static build that embeds in your platform
Start with one game ↗
Ongoing

A games pipeline

Monthly

A steady stream of new games and new cases, planned against your curriculum.

  • A roadmap mapped to your skills framework
  • New games and new scenarios each cycle
  • Playtests with your learners, and fixes from what they show
  • An authoring guide so your team can add cases
Plan a pipeline ↗
Hire

On your team

Full time or contract

A senior product designer who builds, for your games and your learner experience.

  • Game design, UX and UI, and front-end build
  • Learner journeys, mission flow and debriefs
  • Design systems for dense, expert interfaces
  • Remote from Greater Montreal
See my résumé ↗

Who you would work with

A game designer who builds, and who knows cyber training.

I’m Rémi Couture. I have spent nearly twenty years designing game interfaces for teams including Disney, Sony, Riot Games, Tencent and Twitch, and directed UX across nine studios at once. More recently I have worked inside a commercial cyber range on the learner’s first-time experience, mission flow and hub.

  • Design and build from the same hands. What you approve in the prototype is what ships.
  • Learning first. You get the reasoning in writing and the tests that back it, not just a good-looking screen.
  • Honest about status. The eight games here are prototypes with sample content, pending expert review and learner playtests. Closing that gap with your experts is the job.

Mission Control case study ↗

The home screen of a gamified cyber range: hierarchy, onboarding, progression and a live world, as a working prototype.

First-time experience study ↗

Seven design directions and a six-step onboarding that gets a new learner to their first activity.

LinkedIn and recommendations ↗

What managers, clients and teammates say about working with me.

Next step

Play two games with me for thirty minutes.

I will show you how each one was designed, then we will pick the one skill in your curriculum that would make the best first game.

Email me about your platform ↗Message me on LinkedIn ↗

rcouture@gmail.com