Beginner Scenario Template
Beginner Scenario Template
For authors creating new beginner scenarios
This template documents every section of the M&M Beginner Scenario format. Fill in each section using the examples and guidance provided. When complete, your scenario should be runnable start-to-finish without the IM needing to improvise a single word.
NoteWhat makes a beginner scenario different
Standard scenario cards assume the IM knows when to introduce mechanics, how to handle silence, and when to escalate pressure. Beginner scenarios remove all of those assumptions. Tutorial callouts tell the IM exactly when to introduce each mechanic. Every key NPC moment has a read-aloud box. Decision points list 2-3 named options with predicted outcomes. The IM’s job is to read, prompt, and react – not design on the fly.
Front Matter
---
title: "[Malmon Name] Beginner Scenario: [Scenario Title]"
description: "[One sentence describing who this is for and what happens]"
scenario_format: beginner
tutorial_mechanics:
- core-loop
- d20-threshold
- collaboration-bonus
- type-effectiveness
---scenario_format: beginner – Required. Marks this as a beginner format document.
tutorial_mechanics: – List the mechanics introduced in this scenario, in the order they appear. Use the values above.
Section 1: IM Overview
Purpose: Tell the IM at a glance what this scenario is, who it is for, and what to expect.
Format:
## IM Overview
**Malmon:** [Name]
**Setting:** [2-3 words -- e.g., "Small creative agency, Friday deadline"]
**Runtime:** 45-75 minutes (Quick Demo or Lunch and Learn only)
**Players:** 4 (pre-generated team included below)
**Difficulty:** First session -- no prior experience required
[1-2 sentences explaining why this setting makes a good first scenario. What makes
the stakes relatable? What makes containment concrete?]Example:
## IM Overview
**Malmon:** FakeBat
**Setting:** Small creative agency, Friday deadline
**Runtime:** 45-75 minutes (Quick Demo or Lunch and Learn only)
**Players:** 4 (pre-generated team included below)
**Difficulty:** First session -- no prior experience required
A 12-person creative agency two days before a career-defining client presentation.
No regulatory complexity. The crisis is immediately relatable. Symptoms are visible
(browser redirects, pop-ups). Containment means choosing: fix the machines or make
the deadline?Section 2: Before You Begin
Purpose: Minimal prep checklist. Everything the IM needs, nothing they don’t.
Format:
## Before You Begin
**Materials needed:**
- This document (print or screen)
- 1 x d20 die (one is enough -- players can share)
- Role cards for: Detective, Protector, Tracker, Communicator
**No other preparation required.** The scenario, clues, NPC lines, and decision
points are all scripted below. Read through once before running.
**If you have 5 extra minutes:** Read the [IM Overview] and the [Setting the Scene]
box aloud to yourself. The rest flows naturally from there.Section 3: Pre-Generated Team
Purpose: Remove the “what role should I pick?” friction from a first session. Give each player a named character with a one-sentence brief that explains their role in plain English – no game jargon.
Format:
## Pre-Generated Team
Hand out role cards to your 4 players. Read each character name aloud:
- **[Name] (Detective)** -- "You always ask who had access and when. Your job is
to trace what happened."
- **[Name] (Protector)** -- "Your instinct is to isolate first, ask questions second.
You keep the threat from spreading."
- **[Name] (Tracker)** -- "You follow the data trail. You want logs and timestamps
before anyone acts."
- **[Name] (Communicator)** -- "You keep stakeholders calm and the team aligned.
You decide what gets communicated and when."Name guidance: Use plausible first names. Avoid names that suggest a specific nationality, gender, or background unless it fits the scenario context.
Example:
## Pre-Generated Team
- **Jordan (Detective)** -- "You always ask who had access and when."
- **Sam (Protector)** -- "Your instinct is to isolate first, ask questions second."
- **Riley (Tracker)** -- "You follow the data trail. You want logs before you act."
- **Morgan (Communicator)** -- "You keep stakeholders calm and the team aligned."Section 4: Setting the Scene
Purpose: The scripted opening the IM reads verbatim. Sets the setting, establishes the crisis, and tells players what they know at the start. No improvisation needed.
Format:
## Setting the Scene
::: {.callout-note title="Read aloud to players"}
[2-4 sentences establishing the organization, the normal-until-now situation,
and the first symptom that broke the calm. Write in present tense. Describe
what players see, hear, or have just been told. End with an implicit question
or open situation that invites the first action.]
:::Writing guidance:
- Present tense, second person: “It is Tuesday morning. You have just received…”
- Establish the pressure before the symptoms: what was at stake even before the incident?
- End open – do not tell players what to do. The scene is set; the ball is theirs.
Round Structure
Each round follows the same arc:
- A tutorial callout (first round and when a new mechanic is introduced)
- The scene or escalation (what the IM describes)
- Scripted clue prompts (if players get stuck)
- A decision point with named options and stated outcomes
Section 5: Round 1
## Round 1: [Round Title]
::: {.callout-tip title="[TUTORIAL] The Core Loop -- introduce this before Round 1"}
Explain to players:
1. **You describe a situation.** The IM describes what the team observes or learns.
2. **Each player takes one action.** What does your character do? (Ask a question,
run a scan, isolate a machine, call a contact -- anything realistic.)
3. **You describe the result.** Announce what they find, then evolve the situation.
That's it. That's the game.
:::
[Scene description -- 2-3 sentences. What has just happened or been discovered?
What is the immediate situation facing the team?]
**If players get stuck, offer these clue prompts one at a time:**
- **Clue 1 (offer after ~3 minutes):** [Scripted clue IM can read aloud]
- **Clue 2 (offer after ~6 minutes):** [Second clue if needed]
- **Clue 3 (offer after ~9 minutes):** [Third clue if needed]
::: {.callout-tip title="[TUTORIAL] The d20 -- introduce at the first complex action"}
When a player attempts something with uncertain outcome:
1. They describe what they are trying to do.
2. They roll the d20.
3. **10 or higher = success.** Below 10 = partial success or complication.
Simple actions (sending an email, checking a log that is definitely accessible)
succeed automatically. Save the dice for meaningful moments of uncertainty.
:::
**NPC interruption:**
::: {.callout-note title="Read aloud -- [NPC Name] calls/appears"}
[Scripted NPC line. 1-3 sentences. The NPC has a concrete need or reaction.
End with something that implicitly requires a player response.]
:::
**Round 1 Decision Point:**
The team must decide:
- **Option A: [Action name]** -- [What this means in practice. 1 sentence.]
- Outcome if chosen: [What happens next. 1 sentence.]
- **Option B: [Action name]** -- [What this means in practice. 1 sentence.]
- Outcome if chosen: [What happens next. 1 sentence.]
- **Option C: [Action name]** -- [Optional third option. 1 sentence.]
- Outcome if chosen: [What happens next. 1 sentence.]
*Whichever option they choose, move to Round 2.*Section 6: Round 2
## Round 2: [Round Title]
[Opening escalation -- 2-3 sentences. What changed based on Round 1? Even if
players made the "right" choice in Round 1, the situation has developed.]
::: {.callout-tip title="[TUTORIAL] Collaboration Bonus -- introduce the first time players want to work together"}
When two or more players combine their actions toward the same goal:
- They roll **two d20 dice** and take the higher result, or
- One player rolls with a **+3 bonus** to their result.
Collaboration represents the team's combined expertise -- a Tracker's logs plus
a Detective's pattern recognition is more powerful than either alone.
:::
**Clue prompts for Round 2:**
- **Clue 4:** [Scripted clue -- typically reveals more of the villain's method]
- **Clue 5:** [Scripted clue -- typically confirms scope or escalation]
**Malmon card reveal trigger:**
::: {.callout-note title="IM note -- reveal the Malmon card when players identify the threat family"}
When players correctly name or describe the malmon (or come close enough), show
them the [Malmon Name] card and say:
*"[Read-aloud line acknowledging the identification. 1 sentence. Then describe
what the card tells them about the threat's behavior.]*"
If players have not identified the malmon by the end of Round 2, give them this:
*"Your analysis confirms this is [Malmon Name]. [1-sentence plain-English description
of what that means for this situation.]*"
:::
**Round 2 Decision Point:**
The team must decide:
- **Option A: [Action name]** -- [1 sentence.]
- Outcome: [1 sentence.]
- **Option B: [Action name]** -- [1 sentence.]
- Outcome: [1 sentence.]
*Round 2 ends. Move to Round 3.*Section 7: Round 3
## Round 3: [Round Title]
[Final escalation or resolution setup -- 2-3 sentences. The threat is either
contained, escalating, or at a tipping point depending on Round 2 choices.]
::: {.callout-tip title="[TUTORIAL] Type Effectiveness -- introduce during the final response decision"}
In M&M, different responses are more or less effective depending on the threat type.
[Malmon Name] is a **[Type]** type.
- **Super effective:** [Response action] -- [Why it works against this type]
- **Not very effective:** [Response action] -- [Why it falls short against this type]
- **Normal effectiveness:** Everything else
The team should choose responses that match the threat type for the best outcome.
:::
**Final Response Decision:**
- **Option A: [Action name]** -- [1 sentence.]
- Type effectiveness: [Super effective / Normal / Not very effective]
- Outcome: [1 sentence.]
- **Option B: [Action name]** -- [1 sentence.]
- Type effectiveness: [Super effective / Normal / Not very effective]
- Outcome: [1 sentence.]
- **Option C: [Action name]** -- [1 sentence.]
- Type effectiveness: [Super effective / Normal / Not very effective]
- Outcome: [1 sentence.]
**Resolution:**
::: {.callout-note title="Read aloud -- Contained"}
[Scripted ending for the best outcome. 2-3 sentences. What does success look like
for this specific organization and stakes? Be concrete about what was saved.]
:::
::: {.callout-note title="Read aloud -- Partial containment"}
[Scripted ending for a mixed outcome. 2-3 sentences. What did the team prevent?
What will still require follow-up? Frame partial success as a real accomplishment.]
:::
::: {.callout-note title="Read aloud -- Stage 2 triggered"}
[Scripted ending if the villain plan advanced to Stage 2. 2-3 sentences.
Frame this as a learning moment -- the team did real work even if the threat
escalated. What did they learn? What is the next step?]
:::Section 8: Debrief Guide
## Debrief Guide
**Standard closing questions (ask all 4):**
1. "What was the first moment you suspected something was wrong?"
2. "Which decision felt hardest, and why?"
3. "What would you do differently if this happened at your actual organization?"
4. "What is one thing you will remember from today's session?"
**Scenario-specific question:**
[One question tied to the specific learning objective of this scenario. For example,
if the scenario is about phishing, ask something about verification habits. If it is
about software trust, ask about download practices.]
**IM note:** There are no wrong answers in debrief. Your job is to ask, listen,
and occasionally reflect back what you heard. Avoid correcting or lecturing.Section 9: What’s Next
## What's Next
Now that your group has run their first session, here are natural next steps:
**More [Malmon Name] scenarios:**
- [Link to another scenario for this malmon -- intermediate complexity]
- [Link to another scenario for this malmon -- different industry context]
**Try a different malmon:**
- [Link to another tier-1 malmon with a brief reason why -- e.g., "GaboonGrabber
for phishing focus" or "FakeBat for software trust"]
**Upgrade your prep:**
- [Link to a standard preparation template for when they are ready]
- [Link to IM quick start guide section on session formats]