DevSecOpoly

How it works

Monopoly’s shape, none of its engine

Monopoly exists so that players can take money from each other until three of them have none. Remove that, as a cooperative game must, and what is left is four people rolling dice. So the engine is replaced rather than switched off.

• You do not buy a domain, you explain it

  Landing on an unclaimed square opens its trust question — the same question a RockPoint assessment opens with. Answer it out loud, in your own words, and the other players decide whether they are convinced. That is the whole game.

• Being wrong costs a turn and nothing else

  If the table is not convinced, nothing is spent, nothing is lost and the model answer is revealed so everyone reads it together. The square can be claimed next time anyone lands on it. A teaching game that punishes a wrong answer stops people answering.

• Raising a level means arguing for a specific activity

  Each rung is the graph's own maturity activity — "scan every pull request and block new high-confidence issues", not "level 2". You have to say how your organization would actually do it.

• Nobody signs off their own work

  Every player holds one of four duties — Develop, Build, Run or Assure — and every domain belongs to one of them, derived from the roles the graph says own it. The holder of a domain's duty approves work there and may not argue for it. Land on something you own and you hand the explanation to someone else.

• The adversary is the Threat Clock, not each other

  Every lap launches a real attack technique at a real domain. Held at level two or better, it is blocked. Otherwise the breach meter rises and the table reads the incident that technique actually caused.

• Level one defends nothing

  A domain starts defending at level two, because level one activities describe existence and level two describes coverage. Teams discover this by losing to it once, which is the point.

• Breadth is the only way the meter goes down

  The first time a color group starts defending, the breach meter drops by one. Depth scores, breadth survives, and the argument about which to buy next is the thing you are here to have.

• Nobody is eliminated

  There is no rent, no bankruptcy, no trading and no jail as punishment. A payment the team cannot cover raises the meter, because an unfunded obligation is a real gap — but nobody leaves the table.

• One budget, one outcome

  Reach level two across every color group at a total maturity of 44 and the team is Baseline Secure. Let the breach meter reach eight and everyone loses together.