.png)
One Water Utility. Two Teams. Limited Resources.
The Premise
Cyber Realm: Water Sector Edition is a Red Team vs. Blue Team card game set inside a water utility environment. Red Team tiers escalate from Script Kiddies to Hacktivists to Nation-State Adversaries, unlocking stronger attacks like remote access abuse, ransomware, DDoS, supply-chain compromise, water overflow manipulation, and SCADA/ICS intrusions.
Blue Team tiers represent Small, Medium, and Large Water Organizations with different resource levels. Small organizations have limited staff, tools, and defensive options, while larger organizations gain stronger monitoring, response, recovery, and resilience capabilities. Players must manage resources carefully to keep water operations safe and reliable.
SCP - System Control Points
Stable Service
Monitor
At Risk
Service Disruption
20-14
13-7
6-3
2-0
Red Wins
Blue Wins
Drive SCP into Service Disruption
Hold SCP to 7 at the turn cap
The Water System: The Battlefield
Two Teams. Six Tiers of Pressure.
The Red Team
Match the tiers for a fair fight or raise the threat against a smaller utility for a brutal teaching scenario. The flagship Water Sector matchup is Nation-State versus a Large water utility Org.
Three tiers of adversary, each cumulative. A higher threat plays with every card of the tiers beneath it, plus its own.
ATTACKER
SCRIPT KIDDIE
HACKTIVIST
NATION-STATE
LOW THREAT
ELEVATED
CRITICAL
Opportunistic and noisy. Automated attacks, low sophistication, exploitation of legacy systems and misconfigurations.
Motivated and coordinated. Insider threat and credential abuse, lateral movement, targeted intrusions and remote access tools.
Patient, resourced, stealthy. Advanced persistent threat campaigns, supply-chain compromise, sophisticated evasion the full deck, APT operators and all.
T01
T02
T03
The Blue Team
S
SMALL ORG
Community Utility
Lean budget, few assets, little depth. Script-Kiddie threats, limited resources, heavy vendor reliance. Prioritize ruthlessly.
M
MEDIUM ORG
Regional Utility
More Realms and assets, some depth. Insider-threat exposure, backup systems, firewall and SCADA tooling. Real choices, real coverage.
L
LARGE ORG
MAJOR UTILITY
Full NIST coverage and deep assets but nation-state attention, mature security ops, and supply-chain compromise risk. Bring a Hero.
Three sizes of utility, each with a different budget, asset depth, and security maturity. A bigger org means full coverage and a bigger surface to defend.
Defender
Real Attacks.
Real Defenses.
Every match plays out a scenario water utilities actually face. Unauthorized remote access attacks, weak and default credentials, water-overflow manipulation, ransomware, DDoS disruption, supply-chain compromise, and nation-state intrusions into SCADA and ICS. Each defense chain maps cleanly to NIST: Identify, Protect, Detect, Respond, Recover.
DATA EXFIL DEFENSE
STOP THE THEFT
Vet the supply chain, segment IT from OT, and watch the wire. Network segmentation, NIDS, and data-loss prevention cancel exfiltration before it leaves the perimeter.
Claim your Edition
Debuting at AWWA ACE, August 2026. Reserve now to lock conference pricing and Founder allocations.
Launch
LAUNCH
$50/box
Two players, two scenarios - the fastest way into the engagement
Two ready-to-play decks
2 attack/defend scenarios
80 Cards per box
Most Popular
Standard
$250/box
The complete game! Every card, every scenario. Built for utilities, MSPs, and security teams.
Full 324 card training box
All 6 scenarios
Water sector play board
The complete Training Box, individually numbered a single run of 404. Because nothing says cybersecurity like a 404.
400 OF 404 SETS REMAINING
Training Box + 1 Numbered 60 card deck
1 Numbered Founders Identity Card
The Rulebook
The Cyber Realm: Water Sector Edition Rulebook teaches players how to run a Red Team vs. Blue Team cybersecurity battle inside a water utility environment. Players battle over the Water System, the shared battlefield where assets like wells, pump stations, treatment systems, storage, distribution, and customer impact are placed and defended.
Red Team advances through the cyber kill chain using attacker tiers: Script Kiddie, Hacktivist, and Nation-State. Blue Team defends using the NIST Cybersecurity Framework: Identify, Protect, Detect, Respond, and Recover, with organization tiers representing Small, Medium, and Large Water Organizations.
The game uses System Control Points, or SCP, to track the operational health of the water system. Red wins by driving SCP into Service Disruption, while Blue wins by keeping the water system stable through the turn cap. Resources come from six Cyber Realms—Endpoint, Application, Network, Internet, Cloud, and Infrastructure—forcing players to manage limited budgets, prioritize defenses, and make trade-offs just like real-world cybersecurity teams.
Download the rulebook to learn the full setup, card types, resource system, attack chains, defense framework, Water System mechanics, SCP bands, win conditions, and conference demo rules.