Attack path left open
- 01 Vulnerable service
- 02 External payload requested
- 03 Payload reaches the system
- 04 Compromise spreads
Working title · Pre-alpha
Exploit Margin
Can you grow a technology company while professional adversaries work to break in?
Exploit Margin is a business simulation about pressure. AI adversaries study your people, shop dark markets for tooling, and chain 16 attack techniques toward whichever prize pays: your data, your money, or your machines.
Pre-alpha. No public build yet. Playtesters get in first and shape the design.
16 attack techniques 17 security controls 4 adversary objectives
Grow under pressure
Ship features, hire, and win customers quarter by quarter. Every system you add opens new ground an adversary can probe. The market rewards speed and quietly bills you for it later.
Meet your adversaries
AI adversaries run campaigns of their own, with budgets, skills, and patience. They scrape your org chart, buy password dumps and zero-days on underground markets, and pick from 4 objectives: steal your data, ransom your systems, spy on you, or mine crypto on your servers.
- day 12 · recon · employee directory scraped
- day 19 · market · credential dump acquired
- day 26 · phish · finance inbox targeted
- day 33 · intrusion · CRM session hijacked
- day 41 · objective · exfiltration channel opened
Make whole attacks impossible
Patching one flaw closes one door. A security invariant removes the hallway: a machine-enforced property of your infrastructure that blocks a required attack step, for every flaw behind it, current and future. Lay that foundation early and attacks die halfway through.
Default-deny egress invariant
- 01 Vulnerable service
- 02 External payload requested
- 03 Outbound path blocked
- 04 Attack chain stops
Answer the breach
Detection arrives late and certainty arrives later. When an incident lands, you choose among 5 responses with real costs in cash, staff, and downtime. A wrong call turns a bad week into a board meeting.
day 41 · incident detected
Choose your response
Choose your strategy
Every run asks a different question.
Outgrow them?
Scale your platform and perfect product market fit while rivals burn quarters on cleanup.
Outbuild them?
Spend early on foundations that make whole classes of attack impossible, then scale in peace.
Play it darker?
Adversaries take tips. A well-placed lead about a competitor's weakness could clear the market for you.
Development status
The simulation runs today. The public experience is still being earned.
Company building, infrastructure, adversaries, detection, and incident response are playable in the development build; current work is shaping them into a scenario a new player can read without help.
- Current development build
- Standalone simulation against AI companies and adversaries; not publicly available
- In development
- Scenario pacing, onboarding, balance, and an explanatory end-of-run report
- Not promised yet
- Public demo date, multiplayer, or a crowdfunding launch
Why Security Blueprints is building it
Security advice is fragile. Security invariants change the system.
The project grew from studying why sound advice loses to deadlines and budgets. Invariants turn key protections into properties of the infrastructure itself, and the game makes their cost, and the delayed cost of skipping them, something you feel.
Read the research behind the game →“Attackers need one open door. The company has to decide which doors never exist.” Project design principle
Follow development
Want in? Playtest invites go to this list first.
Get development milestones that matter and first notice when private playtests open. Substance over frequency.