Free lab · no signup · about 5 minutes
CISO Risk Desk
You have a $1M budget and ten risks: a crypto hot wallet, a CVSS 10 flaw under active attack, a firewall zero-day, ransomware heading for the plant floor, an AI agent leaking data and more. Accept, mitigate, transfer or avoid each one. Wrong calls cost money or put the company in the headlines.
Loading the desk…
How the money works
- Expected loss = chance it happens this year × the loss if it does.
- Mitigate costs money now and cuts the chance, the size of the loss, or both.
- Transfer costs a premium; the insurer pays a share of the loss above the deductible, up to a cap. Some losses, like many regulatory fines, are not insurable.
- Avoid removes the risk by stopping the activity, which usually costs revenue.
- Return on a choice = (expected loss avoided − cost) ÷ cost. Spending more than a risk is worth is a loss too.
All figures are illustrative teaching numbers for a fictional company, not benchmarks or advice.
Questions
What is the CISO Risk Desk?
A free browser game about cyber risk treatment. You get a $1M security budget and ten risks, from a crypto hot wallet and a CVSS 10 VPN flaw to OT ransomware and an AI agent leaking data. For each one you accept, mitigate, transfer, avoid or ignore it. Then a year is simulated and the board grades your decisions.
What are the four risk treatment options?
Accept means you formally keep the risk. Mitigate means you pay for controls that make it less likely or less damaging. Transfer means you move some of the loss to someone else, usually an insurer, but you still pay a deductible and anything above the cover. Avoid means you stop the activity that creates the risk. Ignoring a risk is not a treatment: nothing is recorded, and regulators and boards treat an unmanaged risk more harshly.
How is the expected loss calculated?
Expected annual loss is the chance the risk happens in a year multiplied by the loss if it does. Each option shows what you pay now and the expected loss afterwards, plus the return on that spend compared with accepting the risk.
How is the grade worked out?
The game finds the best possible plan for the same ten risks and budget, then compares the expected cost of your plan with it. That is your decision score. The simulated year is shown separately, because a good decision can still be unlucky and a bad one can get away with it for a year.
Are the figures real?
No. Likelihoods, losses and prices are illustrative teaching numbers for a fictional mid-size company, chosen to show how the trade-offs work. Use your own data for real decisions.
Keep going
- Log triage labs: spot the attack in the logs, earn certificates.
- IR Playbook Lab: run the response when a risk hits.
- Cyber War Room: lead a full incident as the CISO.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.