Tool of the week
Security toolSecret Scanner
Scan code, config or .env for leaked API keys & secrets — 100% in your browser.
Try itBuild the judgementof a security leader.
Whether you are studying, already working in security or aiming to get in, you learn by making the calls. Work through incidents modelled on real breaches, defend your decisions to a board and practise interviews in hands-on labs, without waiting for the job to hand you the pressure.
Free account, no card: 3 Cyber War Room incidents and the labs. Pro is $5 a month or $40 a year.
Most-used security tools
Scanners, calculators and hands-on labs that run in your browser.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.
Spot the malicious logs in a stream of 1,000 across identity, EDR, cloud, email and network.
Triage realistic security cases from P1 to P4: priority, team and first action.
Work a case from mail, identity, endpoint and network artifacts and find the evidence.
Screen social-media requests and spot the fake profiles, romance scams and impersonators.
Estimate what a breach would cost, grounded in the IBM Cost of a Data Breach benchmark.
Score a vulnerability in CVSS v4.0, v3.1, v3.0 or v2.0, or decode a vector string from an advisory.
What's new
See everything we've shippedPlayCISO Weekly: a plain-English email each Thursday with the week's incidents and AI news, one feature to try and a quick poll.
Twenty browser-based labs covering X.509 certificates, certificate chains, OCSP/CRL revocation, PKI hierarchy design, TLS 1.2/1.3 hardening and handshakes, mutual TLS, hashing, HMAC, AES-GCM, RSA/ECDSA signatures, JWTs, password storage, key lifecycle, Certificate Transparency and entropy — real crypto in your browser, graded.
New pillar hubs for Cryptography, OT/ICS, AI security and PCI/compliance, plus an /llms.txt index and plain-text versions of every blog post so AI assistants can find and cite PlayCISO.
A self-assessment scoring how likely a cyber incident could push your business toward insolvency, across the five death-spiral dimensions — with real case studies and a plain-English verdict. Runs in your browser.
Which seat are you in?
Same product, three different first moves. Pick the one that sounds like Monday morning.
You want the CISO job — or the interview for it.
Score yourself first, then drill the mock interview until your incident story, budget defense, and regulatory answers are automatic.
Start with the free scorecard →You run security — and the board runs you.
Rehearse the worst day before it happens: live incidents graded against real-world regulatory expectations (US-oriented), and a board-report coach for the write-up.
Take a Cyber War Room run →You build and review the systems.
Threat-model on an infinite canvas with an AI copilot, blueprint architectures with live control coverage, and scan what you ship.
Open the architect studios →What PlayCISO is, in plain words
PlayCISO is a practice platform for security leaders and the people who want to become one. You run 25 incident scenarios across 3 fictional companies, each one modelled on a breach that really happened. Every decision is graded against real regulatory frameworks, and a board of AI executives questions your calls at the end.
The same subscription includes a live mock interview with an AI avatar across security roles and industries, a board report coach that drafts, coaches and critiques, and architect studios for threat modelling, architecture design and design review. It also bundles security scanners for packages, prompts, MCP servers, models and browser extensions, plus an AI bill of materials generator, editable templates and 120 reference architecture diagrams.
Pricing is $5 a month or $40 a year, and every plan is the whole product. The 2-minute CISO readiness scorecard, the templates, most arcade games and the sample outputs are free without an account. Under-13s can only use the youth pages with verified parental consent. Scenarios and companies are fictional; nothing here is legal advice.
A quick look inside.
Six surfaces, five seconds each. Every scenario is fictional — inspired by real-world incidents.
Isolate the runner and burn the release window — or trust the WAF rule and ship? You have 42 seconds.
Three things you can only get good at by doing them
Reading about incident command is not the same as running one at 2am. So we let you run one.
Three security-architect studios
Infinite-canvas tools with an AI copilot: you draw, it proposes, you dispose — then export. Threat modeling, architecture design and design review, each on its own canvas.
3 canvases, 3 engines, 1 AI copilot. Every studio exports a PDF; the architecture studio also exports Terraform.
Five security tools, included
Five is the promise — we built them, we use them ourselves, and they come with every subscription. There's more in the box on top of that (AI BOM, a market-aware resume review, and AI SVS as it ships), but the five are what you're paying for.
npm/PyPI trust, typosquat distance, and CVE check.
Static prompt-injection & jailbreak detection.
Static audit of your MCP server config.
Adversarial probes against your model endpoint.
Chrome extension permission + risk scoring.
Turn a manifest into an AI bill of materials.
Market-tailored AI critique of your resume.
AI verification standard — in development.
More ways to practice
7 more ways to practice, 3 of them free with no signup.
Survive a $4M budget cut, beat your peers on the weekly board.
Face hostile reporters after a breach — live, on the podium.
A 2-minute readiness scorecard that shows where you stand.
Live avatar interviewer, US-oriented, security roles.
8-dimension reference architectures to study.
Fast security mini-games — breach, patch runner, SOC.
See real board reports and critiques before you pay.
The threat pulse
week 2026-W46What we're watching — the incidents shaping what the Cyber War Room throws at you. From the weekly PlayCISO briefing.
Identity is the new perimeter — and the new breach
The common thread in recent incidents isn't malware, it's a valid credential used from the wrong place. MFA coverage and session monitoring decide these outcomes.
Supply chain compromises keep starting in CI
Build runners and package registries remain the quiet entry point — the blast radius of one poisoned dependency is your entire release.
Boards are asking sharper questions
Disclosure clocks and personal liability have changed the tone of the CISO seat. The skill being tested isn't containment — it's explaining containment.
Subscribers get this every week — with the AI developments and the one stat worth repeating. Take the free scorecard and it lands in your inbox.
Want it in your inbox? Weekly newsletter
Everything inside
The whole product on one screen: 630 tools and labs, 120 diagrams and 450 posts. Green means free right now; everything else comes with any plan.
- Cyber War Room simulator20 years of incidents, graded by a board
- Board Report coachGenerate, write live, or get critiqued
- Mock interviewAI avatar · security roles, US-oriented
- Press conferenceFace the journalists after the breach
- Threat Model StudioDraw or paste a URL → STRIDE map
- Architecture StudioBlueprints with live control coverage
- Design Review WorkbenchRFC in, triaged findings out
- Org DesignerTeam, budget, KPIs, JDs — from scratch
- Attack Path SimulatorWatch a breach move, hop by hop
- Risk RegisterEvery studio's risks, board-ready
- Cyber PMOProject packs: case → plan → RAID
- Security scannersPackages, prompts, MCP, models, extensions
- Resume reviewMarket-tuned, ATS-aware critique
- AI BOMCycloneDX inventory of your AI stack
- 120 diagrams8-dimension interactive walkthroughs
- CISO-readiness scorecard2 minutes, score + 30-day plan
- Watch a run + make a callGet graded on one live decision
- TemplatesArtefacts, policies, processes, audit
- Cyber Arcade10 games that teach real security
- Sample outputsSee what you get before paying
- Live statsReal activity, refreshed every 10 minutes
Every plan is the whole thing
There's no stripped-down tier. Go monthly if you're building up over time or prepping for an interview, yearly if you're in this for the long haul. You get the same product whichever you pick.
Cancel anytime · 7 bonus days on every plan · no lock-in
Got a team? From $3.50/seat/mo — 5+ seats, 30% off, self-serve checkout.
See all plans & team pricing