Role-Playing Guide
Role-playing in Malware & Monsters isn’t about theatrical performance or elaborate costumes. It’s about bringing your authentic self to a cybersecurity incident response scenario while embracing the perspective and personality of your chosen role. This chapter will help you develop memorable characters that enhance collaborative learning cybersecurity and create engaging team-based security training dynamics that support cybersecurity skills development.
Understanding Character Development
The Foundation: You + Role + Situation
Your Character Is:
- 70% your real self - Name, expertise, personality, values
- 20% role archetype - Detective’s curiosity, Protector’s defensiveness, etc.
- 10% scenario context - How your character fits in this organization
Not Required:
- Acting ability or dramatic performance (although it makes everything more fun)
- Fictional backstories or elaborate personalities
- Accents, costumes, or theatrical elements
- Being someone completely different from yourself
Building Your Character in 5 Minutes
Step 1: Keep Your Real Name Most players use their actual first name, making it easy to stay connected to the character while building team relationships.
Step 2: Embrace Your Role Archetype Each role has recognizable patterns that make them fun and memorable:
- 🔍 Detective - Obsessed with details others miss
- 🛡️ Protector - Takes attacks personally, protective of systems
- 📡 Tracker - Visualizes networks and data flows
- 👥 Communicator - Translates between technical and business
- ⚡ Crisis Manager - Organizes chaos, sees big picture
- 🎯 Threat Hunter - Proactively seeks hidden dangers
Example: Protector Role Card
Protector
🎭 Archetype
💪 Strengths
• Threat Containment: Stopping attacks from spreading
• System Hardening: Implementing security controls
🎯 Focus Areas
• Identifying compromised systems and accounts
• Implementing isolation and quarantine measures
🎪 Roleplay Tips
• Express personal investment in system security
• Think about immediate protective actions
🎲 Game Modifiers
Step 3: Add One Personal Touch Choose something that makes your character memorable: - A work habit or quirk - A particular concern or motivation - A way of talking about your expertise - A relationship to the organization you’re protecting
Character Development in Practice
Detective Character Example
Real Person: Sarah, IT Support Specialist
Role Archetype: 🔍 Detective - obsessed with patterns and details
Personal Touch: Keeps spreadsheets of “normal” vs “abnormal” system behavior
Character Introduction:
“I’m Sarah from IT Support. I’ve been watching our system logs like Netflix for two years, and I notice when things are even 0.2% off normal. Right now, everything feels 15% wrong, and that means we have a problem.”
Character Consistency:
- Refers to data patterns and percentages
- Gets excited about log files and timestamps
- Notices details others overlook
- Takes system anomalies personally
Protector Character Example
Real Person: Marcus, Software Developer
Role Archetype: 🛡️ Protector - treats systems like family
Personal Touch: Names his security tools and gets angry at attackers
Character Introduction:
“I’m Marcus from Systems Administration. These servers are my children, and someone just tried to hurt my babies. I’ve got Firewall Fluffy and IDS Spike ready to defend our house, and I’m not happy about this intrusion.”
Character Consistency:
- Refers to systems with parental protectiveness
- Uses military or defensive metaphors
- Takes security breaches personally
- Focuses on immediate protection and containment
Communicator Character Example
Real Person: Jamie, Risk Management
Role Archetype: 👥 Communicator - translates between worlds
Personal Touch: Already mentally preparing explanations for executives
Character Introduction:
“I’m Jamie from Risk Management. I’m the one who explains to our CEO why ‘just unplug everything’ isn’t actually a solution. I’m already calculating compliance implications and figuring out how to keep stakeholders calm while we fix this.”
Character Consistency:
- Thinks about business impact and communication
- Translates technical concepts into business language
- Worries about stakeholder reactions
- Focuses on managing the human side of incidents
Staying in Character
Natural Character Consistency
Use Your Role’s Perspective: Instead of generic responses, filter through your character’s viewpoint:
- Generic: “We should check the network.”
- Detective: “I want to see the network logs - there’s got to be a pattern in the timing.”
- Protector: “We need to isolate the infected systems before this spreads further.”
- Tracker: “Let me map the data flows - I can visualize where this is going.”
Ask Character-Appropriate Questions:
- Detective: “What evidence are we missing? What doesn’t fit the pattern?”
- Protector: “What systems are most vulnerable? How do we stop this now?”
- Tracker: “Where is data going? What connections look suspicious?”
- Communicator: “Who needs to know about this? How do we explain the impact?”
- Crisis Manager: “What’s our priority order? How do we coordinate response?”
- Threat Hunter: “What else might be hidden? Where should we look next?”
Balancing Character and Expertise
When Your Real Knowledge Conflicts with Character:
Your real expertise always takes priority over character limitations. If you know something important, share it - just do it in character.
Example:
Real knowledge: You’re a network security expert who knows about advanced persistent threats
Character: Detective focused on log analysis
Solution: “Looking at these log patterns, my detective instincts are telling me this might be more than a simple intrusion - the persistence mechanisms look like an advanced persistent threat.”
Character Interactions and Team Chemistry
Building Team Dynamics
Complementary Characters:
- Detective and Tracker can collaborate on evidence analysis
- Protector and Crisis Manager can coordinate defensive responses
- Communicator and Crisis Manager can handle stakeholder management
- Threat Hunter and Detective can uncover hidden threats
Character Tension (Productive):
- Protector wants immediate action vs Detective wants more analysis
- Crisis Manager focuses on coordination vs roles want to act independently
- Communicator worries about business impact vs technical roles focus on threat
Character Moments That Enhance Learning
When Characters Disagree:
Use character perspective to explore different approaches:
Detective: “We need more data before we act - what if we’re wrong about the threat?”
Protector: “Every minute we wait, this thing could be spreading to more systems!”
Communicator: “Can we do both? Start containment while gathering more evidence?”
When Characters Celebrate:
Acknowledge team successes in character:
Tracker: “Beautiful work isolating that data flow - we’ve got them cornered!”
Detective: “The pattern is finally clear - this is exactly how they got in!”
Crisis Manager: “Excellent coordination everyone - we’re ahead of schedule!”
Advanced Character Techniques
Character Growth During Sessions
Round 1 Character Reactions:
How does your character feel about discovering the threat?
- Detective: Excited by the puzzle, concerned about complexity
- Protector: Angry about the intrusion, determined to fight back
- Tracker: Fascinated by attack patterns, worried about data loss
Round 2 Character Development:
How does understanding the scope change your character?
- Detective: More focused, following evidence trails
- Protector: More strategic, planning comprehensive defense
- Communicator: More concerned, calculating business impact
Round 3 Character Resolution:
How has this incident changed your character?
- Detective: Satisfied by solving the puzzle, planning better monitoring
- Protector: Relieved systems are safe, implementing stronger defenses
- Crisis Manager: Proud of team coordination, documenting lessons learned
Character Voice and Language
Develop Consistent Speech Patterns:
Detective Language:
- “The evidence suggests…”
- “I’m seeing a pattern where…”
- “The timeline doesn’t add up…”
- “Something’s not right about…”
Protector Language:
- “We need to defend against…”
- “I’m not letting this thing…”
- “Time to deploy countermeasures…”
- “Our systems are under attack…”
Tracker Language:
- “Data is flowing to…”
- “I’m seeing connections between…”
- “The network is telling us…”
- “Following the digital trail…”
Communicator Language:
- “From a business perspective…”
- “We need to inform stakeholders that…”
- “The impact to operations is…”
- “How do we explain this to…”
Common Role-Playing Challenges
“I Feel Silly Talking in Character”
Remember:
- You’re not acting - you’re problem-solving from a specific perspective
- Other players are focused on the scenario, not judging your performance
- Character voice develops naturally over time
- Authenticity matters more than theatrical skill
Start Small:
- Use your character’s name when introducing ideas
- Ask questions your character would ask
- Express concerns your character would have
- Build complexity gradually as you feel comfortable
“My Character Conflicts with My Knowledge”
Always Prioritize Learning:
If you have important knowledge, share it - just frame it through your character:
“As a Detective, my instincts are telling me this looks like [technical concept you know about]…”
“My Protector training is saying we should consider [security measure you’re familiar with]…”
“I Don’t Know How My Character Would React”
Default to Your Real Reaction: When unsure, respond as yourself but through your role’s perspective:
- What would you actually do in this situation?
- How does your role’s focus change that approach?
- What concerns would your character have?
- What questions would your character ask?
Character Development Worksheet
Before Your Session:
Basic Character Information:
- Name: [Your real first name]
- Role: [Detective/Protector/Tracker/Communicator/Crisis Manager/Threat Hunter]
- Professional Background: [Your real expertise]
- Character Quirk: [One memorable trait or habit]
Character Motivation:
- Why do you care about protecting this organization?
- What would devastate you if it were compromised?
- How do you approach problems in your area of expertise?
- What’s your biggest professional concern?
Character Voice:
- How do you talk about your work?
- What phrases or analogies do you use naturally?
- What gets you excited or frustrated?
- How do you interact with teammates?
Integration with Learning Goals
Character as Learning Tool
Different Perspectives Reveal Different Insights:
- Detective perspective focuses on evidence and analysis
- Protector perspective emphasizes immediate response and defense
- Tracker perspective reveals data flows and network relationships
- Communicator perspective highlights business impact and stakeholder needs
Character Decisions Deepen Understanding:
When you make choices as your character, you explore:
- How different roles prioritize differently
- Why certain approaches matter more to specific functions
- How team coordination requires balancing perspectives
- What real incident responders consider important
Character Growth as Learning Outcome
By the End of Your Session:
- Your character has “lived through” a cybersecurity incident
- You’ve experienced decision-making from a specific role perspective
- You understand how different functions contribute to incident response
- You’ve practiced collaborative problem-solving in a realistic context
The best characters in Malware & Monsters are authentic people who embrace their role’s perspective while contributing their real expertise. You don’t need to be a great actor - you just need to be a great teammate who thinks about problems from your character’s point of view.
What’s Next
Now that you understand how to develop and play your character effectively, you’re ready to explore the containment systems and security controls your incident response team will use to counter Malmon threats. Understanding these tools and techniques will help you make informed character decisions and contribute effectively to your team’s response strategy.
Continue to The Containment System to learn about the security tools and techniques your team will use, or jump to Maximizing Learning for strategies to get the most educational value from your sessions.