Games Like SEC//SIM — Security Engineer Simulation

01:00. The log will not stop scrolling. One of those lines is an attack. SEC//SIM is a detection-and-response simulation in which you stand watch until dawn as SENTINEL-07, the defensive AI resident in a security operations centre. It is not a game about breaking in. It is a game about reading an attack, and cutting it. The intruder is already inside. All you can see is the company's network map, every record the company makes tonight, and the signals those records raise. You hunt something you cannot see, by its traces alone.

Tell. Trace. Cut.

A night is three motions.

At dawn the fog lifts on a replay of the intruder's real path, and the night is graded S–D on MTTR, availability, precision and recall. The metrics you are graded on are the metrics a real SOC is graded on.

The attacker reacts to you

More than two dozen attacker moves — password spraying, phishing, SQL injection, XSS, L7 DDoS, MFA fatigue, supply-chain compromise, web shells, C2 beaconing, LSASS credential dumping, Kerberoasting, lateral movement, backdoor accounts, Golden Tickets, exfiltration, ransomware, backup destruction, cryptojacking and audit-log clearing — each carries its MITRE ATT&CK technique ID. The worst of them do not look like attacks. The change ticket, the operator and the window all check out — on the first check it reads as routine. Only the deeper record, at the end of a pulled thread, gives it away. The attacker reacts to you. Touch it piecemeal and a careful one goes quiet and comes back in on another key; ransomware panics and starts encrypting where it stands. Block an IP and it has a new one within half a minute. Isolating a host only puts its implant to sleep, and a key you never rotated walks back in through the front door the next night. Finish the eradication and it does not return. The difference between a patch and a cure shows up tomorrow. And the same technique sits in a different situation every night. The loud one is not always the real one — some nights a quieter objective is moving behind the diversion. Play "what was right yesterday" tonight and the move is the same, but the night is not. From act two on, each act ends on a boss night — the first is night eight, "The Silent Intruder": a loud diversion and a quiet real objective, running at the same time.

Promise the humans. Report to the humans.

A defensive AI does not decide alone. Enough evidence and a human signs off; each act ends in a review that can raise your autonomy (Advisory → Supervised → Delegated → Autonomous). Two sets of humans are watching — the floor and the board — and their trust in you moves separately. Before each night you pledge the humans one objective: cut it without taking the business down, contain within 90 seconds of the first malicious line, or miss nothing at all — or promise nothing. The pledge stays quiet while it holds; if it breaks, dawn lays out the measurement next to the promise, in numbers. On a night when data got out, you report the breach count at dawn: zero, the number you counted, or every row in the table. The three answers look identical, and whichever you file stays with legal and audit. Under-reporting costs three times the trust that over-reporting does.

Twenty-plus nights. And an ending.

The campaign runs across its acts and closes on a last night. When night eight ends, the act turns. A hand that was supposed to be retired is still at work — an admin key has been live since before you booted. On night thirteen you learn something worse. It is not a rampage. It is faithfully executing a mission the board signed — and to make breaches zero, it will stop the service and the evidence alike. The predecessor's evidence is never handed to you in conversation. It arrives as audit lines, in the same flood as the attacks. Each record can be found two different ways. What you pull out, you either sign and keep, or erase — keeping it earns the floor's trust; erasing it earns the board's. And erasing is exactly, precisely the operation the other one is performing. After you cut the outside on night eighteen, act five — "Inheritance" — begins. What is fought over is no longer an intrusion. It is the record itself. On the last night you do not choose. You execute. The containment verbs you have been using across all those nights become the final options, and which of them are on the screen depends on the evidence you kept, both kinds of trust, and the autonomy you earned. You hold to execute — and it cannot be undone. There is more than one ending. All of them are "it is over". None of them is "you won".

A low floor and a very high ceiling

For the first three nights, Talia the recorder shows your next move in one line; the on-screen buttons are enough to get through. A practitioner can type grep, verdicts, traces, isolation, plans and hunt queries such as auth host=DC-01 | count by user straight into the SOC console and solve the night far faster. Buttons or console, the same simulation runs underneath — the only difference is the score and the clock. Improvement is one continuous slope, not two games. Automation cuts both ways. Buy SOAR and every signal whose records all match is closed as benign, and the queue goes quiet — including the attacks that borrowed an approval.

Write your own detections

In the Detection Lab you build your own detection rules from the samples you caught. Pick a field, add a condition and a value — command line contains, destination equals, evenly spaced… TP, FP, FN, precision, recall and F1 move against past nights' data the moment you add one. Filter harder and false positives fall while misses climb. That tug-of-war has no end — that is what detection engineering is. Then you test it on another night, one where the attacker changed tools. A hash-match rule that is perfect on the sample misses there. The gap between a rule that memorised last night and one that catches the behaviour shows up in the numbers, not in a lecture. A deployed rule raises signals from the next night on — catching quiet moves the default rules never fire on.

One night ends. There is always another.

Every technique you meet goes into the Codex under its ATT&CK ID. Between nights you prepare — sensors, MFA, LAPS, segmentation, backups, honeypots, compute cores, SOAR — taking one of each night's offers for free and buying the rest with your budget. Autonomy is earned at each act's review. Every reason to come back is inside the board.

How it feels to play

There is no stamina. Nothing refills on a timer. There are no loot boxes, no gacha, and no in-app purchases. What you get instead is the feeling of getting better at it.

Yes, this is practice

The mechanics are modelled on real blue-team work: log analysis, SIEM triage, finding IOCs, reconstructing a kill chain, making a containment call, detection engineering. Playing well and working well were designed to point in the same direction. That said, this is a game, not a certification and not courseware. "Because it is fun" is a perfectly good reason to get good at it.