A Threat Modeling Game for Infrastructure (Cyberwarfare)

TL;DR

• Black Start is a threat modeling card game for the people who design, buy, integrate and run the systems that keep a country fed, watered, powered, moving and paid.
• The adversary is a state: patient, well resourced, and after an effect, not a ransom.
• Two decks, The Campaign (what the adversary does) and The Estate (what you are defending), 245 cards and 231 threats.
• You play it against your own design, and you leave with a findings log your team can act on.
• Every card’s ID is an entry in the Critical Infrastructure (Cyberwarfare) Threat Taxonomy, which is the game’s reference.

Why now?

Overnight on 11 to 12 October 2026, the refrigeration controllers of hundreds of French supermarkets were forced into defrost. Cabinets heated to as much as 50C, stock was destroyed and some equipment caught fire. On 2 November a second wave hit supermarkets and food businesses in Sweden, Belgium, Ireland, Luxembourg, Estonia, Italy and Denmark (The Hacker News, DR, Today.it).

Nobody has been officially named for either wave, and the Paris prosecutor’s investigation is still open. Many people read a strike in one country followed by a multinational one as a test of the mechanism, and then a warning. That is an interpretation, not a finding. What is not an interpretation is that the mechanism worked, twice, and that the damage came from a built-in maintenance function, defrost, run at the wrong moment on hundreds of sites at once.

It is not an isolated story either:

• Pre-positioning. In February 2024 CISA, NSA and FBI reported that PRC state-sponsored actors were inside the IT networks of US communications, energy, transport and water organisations, in some cases for at least five years, holding access to disrupt operational technology in a crisis (CISA advisory AA24-038A).
• The air. In September 2025 drones circled Copenhagen airport for hours and air traffic was suspended. Denmark’s prime minister called it the most serious attack on Danish critical infrastructure to date (Euronews). In August 2026 a drone carrying explosives was found at Leipzig/Halle airport, and on 1 September the German government said it held Russia responsible (Euronews).
• Hybrid sabotage. Hours before the Paris Olympics opened in July 2024, fires were set in trackside conduits carrying signalling cables on three high-speed lines, and about half of services were cancelled (The Local).

The people who design these systems are rarely in the room when this threat is discussed. Black Start puts them there, with their own design on the table.

What is Black Start?

Black Start is a trick-taking threat modeling card game in the family of Elevation of Privilege. The name comes from the grid: a black start is restarting a power system from total blackout. The game is about making sure you never need one, and about how long it takes if you do.

It covers food retail and the cold chain, water and wastewater, electricity, gas, fuel, transport and logistics, payments, and the platforms that run them all remotely. It is jurisdiction-neutral and sector-neutral.

You play against your own design, not a made-up one. Every card is a threat. You play it by saying how it could happen in the system you drew, and the table answers three mitigation prompts on the card. One player writes everything down. At the end you have a findings log.

You do not need to be a security specialist. The cards carry the knowledge of the adversary; the people at the table carry the knowledge of the plant, the platform and the people who run it. Black Start needs both.

Two decks

• The Campaign (116 cards) is what a state adversary does, roughly in order: Reconnaissance and Mapping, Pre-positioning, Service Chain, Process Effects, Scale and Timing, Recovery Denial, Aftermath and Deniability, and Air and Spectrum.
• The Estate (129 cards) is what you are defending: Field Devices and Controllers, Control Centre and SCADA, Fleet Management Platforms, Remote and Vendor Access, Telecoms and Timing, Logistics and Supply, Transport Networks, Interdependencies, and Money and Payments.
• Ten Trumps in both decks are the structural hazards of essential services as a whole: One console, a thousand sites, Vendor monoculture, The adversary has time, Every feature is dual-use, Safety cases assume accidents, and five more.

Each deck plays on its own. Reach for The Estate when you are designing a component; reach for The Campaign when you want to think like the adversary across the whole estate. Each deck also has a quick-reference card and a taxonomy card with a QR code.

The look is a control-room mimic panel: the wall diagram where operators see power, water, gas and cold chain lines, breakers and lamps. Every suit has its own colour and symbol, so the cards still read in grayscale, and a strip of lamps shows each card’s severity.

How a session runs

1. Draw the estate. On the estate map, draw the design you are reviewing: the sites, the field devices, the control centre, the fleet platform, the vendors and their access, the links and clocks, and what depends on what. Ten minutes is enough. If you cannot draw a part of it, that is your first finding.
2. Choose a deck and two or three suits. Add the ten Trumps. Three suits and the Trumps is 49 cards: an hour to ninety minutes with three to six players.
3. Name a Scribe. The Scribe plays as normal and keeps the findings log: the card ID, where on the drawing, what could happen, and what the table decided.
4. Optionally, name a Duty Officer. The Duty Officer speaks for the people who run the service at three in the morning and the public who depend on it, and can challenge a player who says a threat does not apply.
5. Play tricks. Follow suit if you can. The highest card of the suit led wins unless a Trump is played. Ace is high, because the ranks follow severity.
6. Make it real. To play a card, say how its threat applies to the drawing. The table answers the card’s three prompts, and the Scribe logs it, or logs why it does not apply.
7. Score. One point for a threat that applies, one for taking the trick, and one for a Duty Officer challenge the table accepts.

One card, in full

BKS-FM-A · One command reaches every site †

One operator, or one stolen session, can send a dangerous command to every site at once. Nothing limits how many sites one action can touch.

The mitigation prompts:

1. What limits how many sites one session can command?
2. Which commands need a second person, a delay or a local OK?
3. How fast can you see and stop a fleet-wide change?

The principle a sound design follows: the blast radius of any single command is bounded by design, not by who happens to be logged in. The design measures, mappings and the supermarket case are on the Fleet Management Platforms page.

The † marks a threat with a physical-safety consequence: fire, poisoning, flooding, explosion, or loss of heat or water in winter. Do not accept one of those without the person who owns process safety in the room.

The game came first

Black Start came first. The Critical Infrastructure (Cyberwarfare) Threat Taxonomy is the reference for the card game: every card’s threat, the mitigation principle a sound design follows, design measures, and mappings to STRIDE, CAPEC, CWE, MITRE ATT&CK for ICS and the Cyber-Informed Engineering principles. The ID on every card, such as BKS-FM-A, is the ID of its taxonomy entry, so after the game anyone can look up what a sound design does about each finding.

I’ll write about the taxonomy itself, and how it maps to those frameworks, in two separate posts.

Note to operators

Play it on the estate you actually run, not the one on the architecture slide. The fleet platform, the remote access your vendors still have, and the manual procedures nobody has rehearsed are where most of the findings will be.

Note to vendors

If you sell a controller or a platform that runs many sites, play The Estate against your own product. Your customers inherit your defaults, and a single default can become a national event.

Note to integrators and service providers

You hold access to many operators at once. That makes you part of their estate, and part of the adversary’s campaign. Play the Service Chain and Remote and Vendor Access suits with your customers.

Credits

The trick-taking format comes from Elevation of Privilege by Adam Shostack, released by Microsoft under the Creative Commons Attribution 3.0 licence. Black Start reuses none of its card text or artwork.

Black Start builds on the approach in my book, Threat Modeling Gameplay with EoP (Packt, 2024): make the threats concrete, make everyone at the table speak, and write it all down.

The threats are drawn from public research, government advisories and the way these systems are built. The taxonomy cites the public cases, and gives attribution only where an official body made it.

Final Thoughts

I don’t think a card game will stop a state. What it can do is put the people who design essential services in a room, with their own drawing, and make them say out loud how one command, one vendor or one drone could take it down, and what they will change. That conversation is cheap now and very expensive later.

Let’s make the systems we all depend on a little harder to switch off.

Stay tuned!