Featured tool
LiveDevSecOpoly
A cooperative board game for teaching software supply chain security. It looks like the board game you already know, and then it does the opposite: nobody wins alone. The team shares one budget, one breach meter and one goal.
We built it to teach salespeople the vocabulary of DevSecOps, and it turned out to work just as well on engineers, on executives and in onboarding.
The board is a prototype: it runs in your browser, reads every space from Gantry and keeps no state. You do not have to play it to read it — every square opens on the full model whether a game is running or not.
How it plays
- 01
One shared budget
There is no personal cash. Landing on an unmanaged capability category lets the team invest from the shared treasury, and there is no rent between players because the team is the only owner.
- 02
One breach meter, zero to eight
It rises on a Cyber Breach landing, on triple doubles, and whenever the team cannot fully cover a payment. If it reaches eight, everyone loses together.
- 03
Defense in depth pays
The first time any capability category reaches maturity level two, the breach meter drops by one. Breadth beats depth early, which is the lesson.
- 04
Build on your turn
Open the build panel to raise the maturity of anything the team owns, or mortgage a property for emergency cash. A mortgaged category stops counting toward the score.
- 05
Two ways to win
Reach a maturity score of 44 for Baseline Secure, which is an average of level two across all 22 categories. Reach 88 while owning every delivery methodology and cloud platform for the stretch goal, Fully Hardened.
- 06
Everything is real
Every space, card and briefing is read live from Gantry. The house and hotel upgrades on each property are the actual maturity ladder a RockPoint Cyber assessment scores against.
The board
If you have played the original, you already know the geometry. Everything on it has been replaced with the real model.
| Monopoly | DevSecOpoly |
|---|---|
| Properties | 22 capability categories across 8 lifecycle color groups |
| Railroads | Delivery methodologies: CI, CD, GitOps, Platform Engineering |
| Utilities | Cloud platforms: Azure, Amazon Web Services |
| GO | Kickoff — the team collects its security budget |
| Jail | Incident Response |
| Free Parking | Security Champions |
| Go To Jail | Cyber Breach — the meter goes up |
| Chance | Best Practices cards |
| Community Chest | Software Supply Chain cards |
| Houses and hotel | Maturity levels L1 to L4, then Hardened |
Why a game
Supply chain security is a systems problem, and systems problems are hard to teach with slides. They are easy to teach with consequences.
When the breach meter rises because the team could not cover a payment, the lesson about underfunding incident response lands in a way a bullet point does not. When taking one category to level two drops the meter, players work out defense in depth for themselves within about two turns.
Because the board is read from Gantry, the categories players argue over are the same ones their organization will be assessed against. Every property briefing carries the real framework mappings, a real incident and the actual maturity ladder, so a player who wants to go deeper can.
Use it for
- Sales enablement, so the team can hold a technical conversation
- Engineering onboarding in the first week
- Executive workshops, as a 90-minute format
- Security Champions kickoff
Run it with your team.
We facilitate sessions for groups of two to six players, in person or remote, and leave you the facilitator materials so you can run it yourself afterwards.