Game Configuration Guide
Modular Game Configuration System
This guide empowers Incident Masters (IMs) to tailor session length and complexity to their needs, ensuring a perfect fit for any group or timeframe, while always preserving full narrative immersion.
Key Innovation: One game system with configurable parameters, not separate βmodes.β IMs can either:
- Use a template (Quick Demo, Full Game, etc.) and optionally adjust individual options.
- Configure from scratch using the grouped options system.
Core Design Principles
Full Narrative Always Preserved π
No matter which configuration you choose, storytelling remains constant:
- β Full scenario hooks - No compression, no editing.
- β Complete NPC characterization - Full backstory and personality for all NPCs.
- β All organizational context - Stakes, politics, emotional investment.
- β Evolution mechanics - Non-negotiable core feature (like PokΓ©mon evolution).
Time savings come from gameplay structure, NOT narrative cuts.
Configuration Templates + Flexible Options
Two approaches for IMs:
1. Start with Template (Easiest)
- Select from standard templates: Quick Demo, Lunch & Learn, Full Game, Advanced Challenge.
- All configuration options pre-filled.
- Occasionally adjust individual options from template starting point.
2. Configure from Scratch (Most Flexible)
- Choose each option individually based on time budget and player experience.
- Use grouped options system (Major/Moderate/Minor/Complexity).
- Calculate time estimate with each selection.
Configuration Groups by Time Impact
Options are grouped by how much they affect session length:
- MAJOR (30+ min impact): Number of rounds, actions per player.
- MODERATE (10-20 min impact): Investigation structure, response structure, team size.
- MINOR (5-10 min impact): Success mechanics, debrief length, turn timers.
- COMPLEXITY (no time impact): Attack complexity, evidence type, difficulty settings.
Configuration Templates (Pre-Configured Session Types)
Template 1: Quick Demo π
Target Time: 35-40 minutes
When to Use:
- Conference booths and expo demonstrations.
- βLunch and learnβ quick introductions.
- βIs this framework right for us?β evaluation sessions.
- First-time player onboarding.
Pre-Configured Settings:
- MAJOR: 1 round, 1 action per player.
- MODERATE: Guided investigation, Pre-defined response, 2-3 players (hybrid roles).
- MINOR: Automatic success, Quick debrief (5 min).
- COMPLEXITY: Single vector, obvious evidence, clear containment, essential NPCs (2-3).
Experience: Fast-paced introduction to M&M with full storytelling but streamlined gameplay.
Customize This Template:
- Add 5-10 min: Change to Standard debrief.
- Add complexity without time: Switch to subtle evidence or add red herrings.
- Make easier: Keep all settings as-is.
Template 2: Lunch & Learn π±
Target Time: 75-90 minutes
When to Use:
- Department training sessions.
- Team building activities.
- Professional development workshops.
- Regular security awareness sessions.
Pre-Configured Settings:
- MAJOR: 2 rounds, 2 actions per player.
- MODERATE: Guided investigation, Pre-defined response, 4-6 players (standard roles).
- MINOR: Dice mechanics, Standard debrief (10 min).
- COMPLEXITY: Single or multi-stage (adjust for team experience), clear containment.
Experience: Substantial collaborative session with guided structure and comfortable pace.
Customize This Template:
- Reduce to 60 min: Change to 1 action per player.
- Add 15-20 min: Switch to Open investigation or Creative response.
- Make harder: Add subtle evidence or red herrings.
Template 3: Full Game (Standard Workshop) π―
Target Time: 120-140 minutes
When to Use:
- Training workshops and full sessions.
- Team skill development.
- Comprehensive security education.
- Standard M&M experience.
Pre-Configured Settings:
- MAJOR: 3 rounds, 2 actions per player.
- MODERATE: Open investigation, Creative response, 4-6 players (standard roles).
- MINOR: Dice mechanics, Standard debrief (10 min).
- COMPLEXITY: Multi-stage, mixed evidence, moderate challenge, full NPC cast (4-6).
Experience: Complete M&M experience with deep investigation, creative problem-solving, full learning.
Customize This Template:
- Reduce to 90 min: Change to 2 rounds OR 1 action per player OR Guided investigation.
- Add 20-30 min: Extended debrief + Complex tracking.
- Make harder: Add red herrings, subtle evidence, ambiguous containment.
Template 4: Advanced Challenge β‘
Target Time: 150-170 minutes
When to Use:
- Experienced team advanced training.
- Competitive events and tournaments.
- Security professional development.
- Badge progression focus.
Pre-Configured Settings:
- MAJOR: 3 rounds, 2 actions per player.
- MODERATE: Open investigation, Creative response, 4-6 players (standard roles).
- MINOR: Complex tracking (Network Security Status), Extended debrief (15-20 min).
- COMPLEXITY: Multi-stage, subtle evidence, red herrings, ambiguous containment, full NPCs.
Experience: Maximum depth, challenge, and competitive elements with comprehensive badge progression.
Customize This Template:
- Reduce to 120 min: Remove Complex tracking OR reduce to Standard debrief.
- Add time: No need - this is maximum configuration.
- Make easier: Switch to obvious evidence, remove red herrings.
Grouped Configuration System (For Custom Configurations)
MAJOR TIME IMPACT (30+ minutes) - Choose These First
These are your time budget levers - they have the biggest impact on session length:
| Option | Choices | Time Impact |
|---|---|---|
| Number of Rounds | 1 / 2 / 3 rounds | 1 round: ~30 min base 2 rounds: ~60 min base 3 rounds: ~90 min base |
| Actions per Player | 1 / 2 actions per round | 1 action: -10 min/round 2 actions: standard |
Quick Reference:
- 1 round + 1 action = ~20 min gameplay
- 2 rounds + 1 action = ~40 min gameplay
- 2 rounds + 2 actions = ~60 min gameplay
- 3 rounds + 2 actions = ~90 min gameplay
MODERATE TIME IMPACT (10-20 minutes) - Fine-Tune Your Target
These options adjust how rounds play out:
| Option | Choices | Time Impact |
|---|---|---|
| Investigation Structure | Guided / Open | Guided: -10 min/round (IM presents clues on timeline) Open: standard (players choose investigation paths) |
| Response Structure | Pre-defined / Creative | Pre-defined: -10 min/round (IM presents 2-3 clear options) Creative: standard (players develop own approach) |
| Team Size | 2-3 / 4-6 players | 2-3 players: -10 min total (less coordination) 4-6 players: standard |
Guided vs Open Investigation:
- Guided: IM delivers clues at set intervals (5 min, 10 min, 15 min). Players process information and connect dots. Faster, more directed.
- Open: Players choose investigation paths, ask questions, explore. IM responds to their choices. Slower, more sandbox-like.
Pre-defined vs Creative Response:
- Pre-defined: IM presents 2-3 response options with clear type effectiveness. Players choose and execute. Faster, more guided.
- Creative: Players develop their own containment strategy. More freedom, takes longer.
MINOR TIME IMPACT (5-10 minutes) - Polish the Experience
These add small adjustments:
| Option | Choices | Time Impact |
|---|---|---|
| Success Mechanics | Automatic / Dice / Complex | Automatic: -5 min/round (good idea = success) Dice: standard Complex: +5 min/round (Network Security Status tracking) |
| Debrief Length | Quick / Standard / Extended | Quick: 5 min Standard: 10 min Extended: 15-20 min |
| Turn Timer | None / Soft / Hard | None: standard Soft/Hard: -5 min/round (prevents analysis paralysis) |
COMPLEXITY OPTIONS (No Time Impact) - Set Difficulty Independently
These affect challenge and realism, not time. Choose based on player experience level:
| Option | Choices | Impact |
|---|---|---|
| Attack Complexity | Single vector / Multi-stage | Single: One primary attack method (simpler) Multi-stage: Multiple coordinated techniques (advanced) |
| Evidence Type | Obvious / Subtle / Mixed | Obvious: Clear indicators (easier investigation) Subtle: Requires deeper analysis (harder) Mixed: Realistic blend |
| Red Herrings | Present / Absent | Absent: Streamlined investigation Present: More realistic but harder |
| Containment Clarity | Clear / Ambiguous | Clear: Type effectiveness obviously shown Ambiguous: Players must reason through options |
| NPC Count | Essential (2-3) / Full (4-6) | Essential: Fewer characters to track Full: Richer organizational dynamics Note: All NPCs have full characterization regardless |
| Badge Tracking | On / Off | On: Track progression toward badges Off: Skip administrative overhead |
| Reference Materials | Available / Not available | Available: Type charts, ATT&CK references speed decisions Not available: Tests knowledge recall |
Important: Evolution mechanics are always enabled - this is a core M&M feature and not configurable.
Time Calculation Method
Step-by-Step Calculation
STEP 1: Start with rounds and actions (MAJOR)
- Choose number of rounds: 1, 2, or 3.
- Choose actions per player: 1 or 2.
- Get base time estimate.
STEP 2: Adjust for structure (MODERATE)
- Investigation: Guided (-10 min/round) or Open?
- Response: Pre-defined (-10 min/round) or Creative?
- Team size: 2-3 players (-10 min total) or 4-6?
- Apply time modifiers.
STEP 3: Polish with minor options (MINOR)
- Success mechanics: Automatic (-5 min/round), Dice, or Complex (+5 min/round)?
- Debrief: Quick (5 min), Standard (10 min), or Extended (15-20 min)?
- Turn timer: Enforced (-5 min/round) or None?
- Final time adjustments.
STEP 4: Add setup and buffer
- Setup: +5 min (2-3 players) or +10 min (4-6 players).
- Buffer: +15% for group dynamics and discussions.
- Total estimated time.
STEP 5: Set complexity options independently
- These donβt affect time - choose based on player experience.
- Attack complexity, evidence type, red herrings, etc.