Free game · no signup · about 8 minutes
Hunt Desk: Every Hour Costs
Nine leads, 4 analysts and a budget that will not cover them all. A credential dumper on a file server, a domain admin created at 03:00, a vague warning from a supplier. Every hour you hunt costs money; every real threat you skip costs much more. The clock moves 4 hours at a time.
Loading the desk…
How the money works
- Burn rate = analysts on the hunt × $150 per hour.
- Expected loss avoided = chance the lead is real × the loss if it is.
- Expected value = expected loss avoided − the cost to finish. Negative means the hunt costs more than it is likely to save.
- Per analyst-hour = expected loss avoided ÷ hours of work left. Use it to rank leads when people or money run short.
- The halfway signal updates the chance with Bayes' rule. Money already spent is sunk: decide on what is left.
- Windows: a hunt that finishes after the attacker acts is too late, so more analysts can be worth it on urgent leads.
Illustrative teaching scenario: the company and leads are fictional, and every rate, budget, loss and probability is a teaching figure, not a benchmark or advice.
Questions
What is Hunt Desk: Every Hour Costs?
A free browser game about running a threat hunting team on a budget. You get 4 analysts, $15k and a 48-hour shift. Leads arrive in a queue; you choose which to hunt, how many analysts to put on each, and when to stop. Every analyst-hour costs money, and real threats you never settle cost far more.
How do you decide which threat hunt to run first?
Compare expected value. Expected loss avoided is the chance the lead is real multiplied by the loss if it is. Subtract the cost to finish the hunt. When people or budget are short, rank leads by expected loss avoided per analyst-hour, and check the hunt can finish before the attacker acts.
When should you stop a threat hunt?
When new evidence makes it worth less than the next best use of the same people and money. In the game, each hunt gives a strong or weak signal halfway, and the chance it is real is updated with Bayes’ rule. Money already spent is gone either way, so it should not decide whether you continue.
How is the score worked out?
The game replays the same shift with a benchmark policy that uses only what you could see. Your decision score compares the expected value of your choices with the benchmark’s. Whether each lead was really an intrusion is shown separately, because a good decision can still be unlucky.
Are the costs real?
No. The $150 analyst-hour rate, the budget, the losses and the chances are illustrative teaching figures for a fictional company, picked to make the trade-offs visible. Use your own numbers for real decisions.
Keep going
- Threat Hunt Plan Review: flag the flaws in draft hunt plans.
- CTO Threat Brief Review: grade three threat intel briefs and decide what to do.
- SOC Log Triage Trainer: spot the attack hiding in a stream of logs.
- Cyber War Room: lead a full incident as the CISO (3 runs included with a free account).
- Threat management, in plain English: how intelligence, hunting, detection and response fit together.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.