Answer
Malware & Management is a tabletop game of about an hour. Four executives decide how to resource, authorise and defend the technical response to a fast-moving malware incident. An Incident Master (IM) rules.
- The table never touches technical work: it makes at most three Executive Decisions, each an allocation of time, cost and exposure.1
- A d20 roll decides what a decision leads to, never whether the player may decide.1
- Three visible risks (Security, Financial, Reputational) are moved on a board, and the IM declares containment.1
- Containment ends the game, and a two-part verdict follows, not a score.1
Applies toRules from core/rulings.md as of 2026-10-22not playtested or timed
How does a session run?
Diagram structure
- One full brief
brief - Short brief at each inject
inject - Executive Decision (max 3)
decide - Roll only if in doubt
roll - Move risk board
board - IM declares containment?
contain - Two-part verdict
verdict board→containbrief→injectcontain→inject· no, next injectcontain→verdict· yesdecide→roll· doubtinject→decide· menu on cardroll→board· outcome
- One full brief
The IM sets the scene once, at the start.
- Short brief at each inject
New facts arrive as people with a price and a deadline.
- Executive Decision (at most 3 per game)
The table votes on one option from the scenario card's menu. A strict majority is needed and the IM chairs.
- Roll only if in doubt
An option that fits the facts with groundwork done succeeds with no roll.
- Move risk board
The IM moves the three markers aloud after each decision.
- IM declares containment?
The IM alone decides when the incident is contained, and only after the last Executive Decision has resolved. If time runs out first, the IM calls it.
- Two-part verdict
Containment reached or not yet reached if the IM calls time first, plus one cost sentence read off the board.
Who is at the table?
Diagram structure
- The table
table - Incident Master
im - Four fixed seats (vote)
seats - CEO
ceo - CFO
cfo - CIO
cio - CISO
ciso - IM-played NPCs (never vote, decide or roll)
npc - General Counsel
gc - Head of Communications
comms - COO
coo - Chief Risk Officer
cro table→imtable→seatsseats→ceoseats→cfoseats→cioseats→cisotable→npcnpc→gcnpc→commsnpc→coonpc→cro
The standard table is four seats. A fifth to eighth player converts an NPC into a seat, in the order General Counsel, Head of Communications, COO, Chief Risk Officer, and a converted seat has no specialty strengths.1 The CIO is core because containment happens in IT; the CIO and CISO stay separate seats.
How many votes does a decision need?
A tied vote fails and nobody breaks it.1
What does a decision cost?
| Mechanism | What it does | Status |
|---|---|---|
| Risk board | Security, Financial, Reputational each move through Steady, Strained, Serious, Critical. Critical is announced at once with a concrete symptom. | Ruled |
| Financial at Critical | One forced beat: an emergency board call, one sentence per executive, play continues. | Ruled |
| Triangle | 12 points, 4 each on Money, Time, Quality. A point is what the table protects, so spending money is never a goal. | Ruled |
| Arm to risk pairing | Money with Financial, Time with Security, Quality with Reputational. | Ruled |
| Shield and starve | An arm at 7 or more cancels one step of a printed cost on its paired risk. An arm at 2 or less adds one step to it, once per decision. Every shield costs a starve. | Ruled |
| Reset | Arms run 1 to 8 and return to 4/4/4 after each Executive Decision. | Ruled |
| Panic-hired consultant | Bought once by majority, inside Decision 2. Financial one step worse to the end of the session, no benefit, and Money shielding cannot cancel it. | Ruled |
| Timer expiry | With no majority the table hears "no resolution", the decision is spent, and the wait option applies automatically, unrolled and unshielded, with no vote. | Ruled |
| Specialty modifier | Each seat has three specialties graded +3, +2 and +1 on its role card. The proposer of the carried option adds the one the IM rules applies. It stacks with backing. | Ruled |
| Grades per seat | Which strength carries which grade is the assistant's draft. The IM may rule another applies. | Assumed |
| Leadership calls | The first call, the restart vote and the remediation owner are leadership calls on one card. They do not count against the three Executive Decisions. | Ruled |