This educational cybersecurity card game launched in April 2016 to middle and high schools around the United States. In this competitive turn-based game, each player must build a network of asset cards to earn points, and use defense cards to protect their network from the attack and event cards played by their opponents. The goal of the game is to be the first player to reach 30 or more points at the end of a round.

Each player must have their own deck of cards to play, but they can customize the cards in their deck to reflect their own preferred strategy or play style. This also allows for the release of new cards and content in a “booster pack”, extending the replayability of the game and the educational potential. These booster packs contain themed content such as secure software, mobile device security, cybersecurity careers, and more.

This low-tech approach to teaching technical terminology and concepts has generated gross revenue of over $500,000 from the sale of cards and from corporate sponsorships. Sponsors of the game include the United States Air Force, MITRE, Rackspace, Lockheed Martin, General Dynamics, Alamo AFCEA, Geekbus, Sastemic, Our Lady of the Lake University, and others. Sponsors have used this game in their own training and outreach programs and helped to distribute free copies of the game to classrooms throughout the United States.

Since the game launched in 2016, over 50,000 decks and booster packs have been produced and shipped to players and teachers nationwide and internationally. The starter deck has also been translated and produced in Spanish, Japanese, and Arabic.

To support the production of physical cards, I created an internal tool for creating and editing cards. This templating tool was created with Unity3D and output card files in a variety of formats for printing, use in the digital game, and for publishing online. It supported versioning and selecting collections of cards such that an entire pack could be prepared for production with ease.

In 2017, the digital game was released for Windows as a public beta. It featured single-player 1v1 gameplay against a computer opponent. At the same time as the public beta, we also launched two other games: "Pyramid of Knowledge" and "Project Cipher". We decided to build out a common player profile system that shared a virtual currency between these unrelated games, as well as a unified games launcher that would also provide support for updates to the games. Since the public beta release, the game has had about 9,000 downloads directly from the game's website.

Challenges

The production of a tabletop game was a new venture for all members of the team. The logistics of manufacturing, storing, managing inventory, handling purchases, and shipping orders all had their own set of challenges. The unique constraint of producing a physical card game with the intention of giving it away for free to the target audience placed a significant need on securing sponsorships for continued support and development of the game. For the digital version of the game, since our target audience was primarily children, we refrained from collecting personal data from players and kept the authentication system relatively simple.

What Went Wrong

Piloting the game and public beta testing revealed some confusion about some rules in the game and how some cards operated. The feedback was valid and rather than developing new cards, we edited the text of existing cards for the next production cycle. As a result, the abilities of some released cards were changed in subsequent iterations, which meant that it was possible for a player to possess two identically named cards with different in-game effects. This also caused confusion, as the only way to identify the most recent card was by the copyright date at the bottom (assuming that it had changed between the two production cycles). Furthermore, we did not make an errata list available to the public.

Getting our manufacturing cost per deck to a sustainable level was complicated by our mid-tier sponsorship offer. This tier offered custom printed deck boxes, which put the unit cost beyond our wholesale cost due to small batch ordering. By moving this customization offer away from the card decks and onto different packaging (the “classroom box” which was sent to recipients of the donated game), we were able to save 80% on subsequent orders for decks, providing a path for sustainability.

What Went Right

The concept was well-received and the demand for this kind of product has been strong. Sponsorships supported free distribution of the game to teachers and classrooms, which was a great way to reach our target audience without imposing a financial burden on teachers. The manufacturing process was surprisingly easy and the logistics of managing the physical product developed over time into something a bit more streamlined and trackable than when the game launched.

Lessons Learned

Be more clear in describing the phases of play in the game loop, and how cards can be used and resolved in each phase. Invest a considerable amount of time during the initial design phase to analyze the balance of gameplay and the ruleset, because it is much harder to modify these things for a physical product once it is released.

Additional Media

You can find links to purchase the physical version and download the free digital version of the game at can be found on the Cyber Threat Defender website, hosted by UTSA's Center for Infrastructure Assurance and Security.

"MITRE partnership benefits next-generation cybersecurity experts", MITRE, December 2020
"Pokémon move over: Kids defeat cyberthreats with UTSA card game", San Antonio Business Journal, September 2019
"UTSA Releases Computer Games -- to Teach Cyber Security", 1200 WOAI, July 2018
"Blake's Brainiacs: Cyber Threat Defender card game for kids", KSAT, July 2018
"Card game teaches cyber security", KLRN SciTech Now, November 2016
"Cyber Threat Defender: A Card Game for the Hacker Age", San Antonio Report, October 2016
"Local students learn cybersecurity - by dealing with a full deck", San Antonio Express-News, October 2016