Support cards
Support cards are the actions and resources that neither strike nor defend directly but change the game: threat information (threat intelligence, OSINT), backups and snapshots to restore, tools that give more energy or draw cards, moves that slow the opponent down for a few turns. In real security they are the teamwork around attacks and defences: preparation, documentation, automation and recovery after an incident.
How they work in the duel
You play them by spending bandwidth (◆), they apply their effect immediately and then go to the used cards. Some effects last several turns as statuses: for example one less bandwidth or one less draw for the opponent, or attacks that deal less damage against you.
All the cards (61)
Threat intelligence
Information on active attackers and techniques. Draw 2 cards.
Night-shift coffee
The analyst’s night shift. +2 bandwidth this turn.
Restore snapshot
Roll back to a clean state saved before the attack. Restores integrity.
Documentation
Read the docs before acting. Draw a card.
Energy drink
A long shift ahead. For 2 turns you get +1 bandwidth at the start of your turn.
Checklist
Restore 2 integrity and draw a card.
Site visit
Before acting, you go and look at the place: entrances, cameras, weak points. Take the first terrain from your deck.
Tripwire kit
Wires and sensors that set off the alarm for anyone who brushes them. Take the first trap from your deck.
OSINT
Open-source intelligence: social media, websites, public records. Draw 3 cards.
Morning stand-up
+1 bandwidth this turn.
Bug bounty
Take the first attack from your deck.
Cold standby
A spare system, powered off but ready to take over if something fails. Restores 3 integrity.
Emergency patch
An out-of-schedule update to close a serious hole right away. Your most damaged defense recovers 3 toughness.
Weakness analysis
You study the opponent’s system to see where it gives way first. The strongest enemy defense loses 2 toughness.
Shadow IT census
Services and programs that departments use without telling IT are the first to be left unpatched: counting them is the first step. Draw a card and enemy defenses are exposed (+1 damage) for 1 turn.
Offline backup
A copy of the data disconnected from the network: everything can be recovered. Restores integrity.
Throttling
Slow down the opponent’s bandwidth. For 2 turns they have 1 less.
Exploit kit
Your attacks deal +2 damage this turn.
Scheduled maintenance
Regular checks that fix faults before they turn into incidents. Your most damaged defense recovers 2 toughness and you restore 2 integrity.
Failover
When the main system goes down, traffic switches by itself to a twin. Restore 3 integrity and draw a card.
Recovery crew
Technicians who get damaged systems back on their feet after an incident. All your defenses recover 3 toughness.
High availability
Redundant components: if one breaks, the other takes over and the service never stops. For 2 turns you recover 2 integrity at the start of your turn.
Stress test
You push a system past its planned load to see where it breaks. The weakest enemy defense loses 3 toughness.
Access revocation
Take granted privileges away at once. Dissolves one of the opponent’s spells (the most expensive) and you draw a card.
Capacity planning
Knowing ahead of time when resources will run out, before the service stops. Take the first spell from your deck.
Spare parts stock
Disks, power supplies and boards ready on the shelf shorten every failure. Draw 2 cards and recover 3 integrity.
Hardening
Safer configurations everywhere: your defenses become tougher.
Incident response
An incident response plan: contain, clean up, restore. Big heal.
SOAR automation
A script handles the repetitive responses. For 3 turns you get +1 bandwidth at the start of your turn.
SIEM on alert
The SIEM flags every anomaly. For 2 turns attacks against you deal 1 less damage.
Runbook
Take the first defense from your deck.
Tabletop exercise
+2 toughness to your defenses and 2 integrity.
War room
Draw 3 cards and get +2 bandwidth.
Security audit
A deep check that finds and closes every misplaced permission. Dissolves one of the opponent’s spells (the most expensive) and deals 2 direct damage to the core.
Alert triage
You decide which alerts to look at first, so noise doesn’t bury the real incidents. Recover 2 integrity and for 1 turn attacks against you deal 1 less damage.
Threat hunting
You go looking for enemies hidden in the network instead of waiting for alarms. The strongest enemy defense loses 3 toughness and you draw a card.
Host isolation
The compromised computer is cut off from the network: the attacker loses their tools. Enemy defenses in play lose all abilities and the strongest loses 2 toughness.
Cloud scaling
More resources in one click, just for now. +3 bandwidth this turn.
Jamming
Disrupt the opponent’s communications. For 2 turns they draw one card less.
Zero trust
“Never trust, always verify.” For 4 turns attacks against you deal 1 less damage.
Geographic redundancy
Copies of the systems in distant locations: if one falls, the others hold. For 3 turns you recover 2 integrity at the start of your turn; your most damaged defense recovers 2 toughness.
Disaster recovery
The plan to restart a company after a disaster: alternate sites, backups, priorities. Restore 8 integrity and all your defenses recover 2 toughness.
On-demand serverless
Code runs only when needed and you pay only then, but permissions still have to be tight. You get +2 bandwidth and draw a card.
CSPM, cloud posture
A continuous check that cloud configurations stay the right ones. +3 toughness to your defenses and you recover 4 integrity.
Social engineering
Convince someone to switch off the opponent’s strongest defense.
C2 framework
Your attacks deal +2 damage for 2 turns.
Radio silence
On their next turn the opponent cannot play supports.
Social engineering kit
The opponent discards 2 random cards.
Corrosive agent
Malicious code that degrades systems little by little: time works for the attacker. For 3 turns, enemy defenses lose 1 toughness at the start of their turn.
Ability disarm
Agents, rules and alarms get switched off: the equipment is still there, but it no longer protects. Enemy defenses in play lose all abilities while they stay in play.
Data center sabotage
A blow to the infrastructure the opponent relies on, physical or digital. Destroys an enemy terrain (the most expensive) and you draw a card.
Initial access broker
Someone who sells access already obtained to a company to whoever will do the rest: often just a stolen password. Take the first attack from your deck and draw a card.
International takedown
Law enforcement from several countries shuts down the criminals’ servers and forums. Destroys an enemy terrain (the most expensive) and dissolves one of their spells (the most expensive).
Coordinated campaign
3 damage to every enemy defense.
Targeted penetration test
An intrusion test focused on the target’s most important spot. The strongest enemy defense loses 4 toughness.
Forced reset
A reboot imposed remotely: the system returns to its initial state and must be configured again from scratch. The strongest enemy defense returns to its owner’s hand.
War of attrition
Constant, cheap attacks that wear defenders down until they give way. The strongest enemy defense loses 3 toughness; for 2 turns, enemy defenses lose 1 at the start of their turn.
Credential rotation
Keys and passwords change often: the stolen ones soon stop working. Draw a card and for 1 turn attacks against you deal 1 less damage.
Golden ticket
A Kerberos ticket forged with the domain key: whoever holds it walks in everywhere. Fixed by changing the krbtgt key twice. Destroys the strongest enemy defense and deals 2 damage to all the others.
Full restore
Everything is rebuilt from scratch from clean backups: slow, but safe. Restore 14 integrity and all your defenses recover 4 toughness.
SBOM
The list of every component in a piece of software: when a flaw appears in a library, you know at once where to look. The weakest enemy defense loses 2 toughness.
Related guides
To learn the technical side there are the simulated labs: