Robert Luh

Gamification

Serious games for security. PenQuest turns a scientific model of attack and defence into a game: attack, defend, understand.

More about PenQuest at www.pen.quest Play now

PenQuest

A network, two players, real techniques

One player attacks a simulated IT network, the other defends it. Attacks follow the way real intrusions progress: reconnaissance, initial access, lateral movement and finally data theft, manipulation or outage. Systems depend on each other, so one unpatched workstation can open the path to a database.

Scenarios are configurable, from ransomware on a single workstation to large-scale theft across DMZ, LAN and cloud.

PenQuest game board from the defender’s view: a network with DMZ and LAN, the attacker on the left, the history log on the right and a hand of defence cards at the bottom
The defender’s view. The attacker (red) has already taken the mail server offline; the history log on the right shows what the defender detected.

How a turn works

Draw, play, resolve

  1. Draw

    Pick new actions from a selection to refill your hand and buy equipment with credits.

  2. Play

    Spend action points on cards and choose target systems. Dependencies decide what is reachable.

  3. Resolve

    Success, detection and insight are rolled. A history log shows what the other side noticed.

Cards

Five kinds of cards

Every card shows its cost, its effect on confidentiality, integrity and availability, and its rarity.

Asset

The systems in play: servers, workstations, cloud services, OT.

Attack

MITRE ATT&CK techniques, grouped by attack phase.

Defence

D3FEND and NIST SP 800-53 countermeasures.

Equipment

Passive effects, bought with credits.

Support

Add-ons that strengthen, conceal or cheapen an action.

In use

Where PenQuest is played

In university courses, in awareness training and in workshops where organisations explore their risks. Because every card maps to a real technique or control, a game doubles as a structured conversation about a concrete network.

Play against a bot, switch on the quiz mode so that security knowledge affects your chances, or build your own network with DMZ, LAN, cloud and OT systems.

Play PenQuest pen.quest

Version 1.2.4 is online. Version 2.0 with a reworked interface and the Scenario Creator is in development, and the team is looking for alpha testers: robert.luh@ustp.at

From model to game

How PenQuest came about

  1. 2018APT RPGA meta-model of attacker and defender behaviour, built from STIX, CAPEC, CVE/CWE and NIST SP 800-53, designed to drive a role-playing game
  2. 2019PenQuestThe model becomes a board game for security assessment and education
  3. 2022PenQuest ReloadedThe digital version for technical education, presented at IEEE EDUCON
  4. 2025Risk exploration for IT/OTPenQuest as a tool to explore attack paths and defences in IT and OT infrastructures, published in Computers & Security
  5. 2026PenQuest 2.0Reworked interface and Scenario Creator, in development

Team

Who makes PenQuest

  • Robert LuhGame design and model
  • Sebastian EresheimBackend and AI
  • Thomas PetelinBackend and frontend
  • Nico GentiliniScenario Creator
  • Maximilian RieglerUI and visual design

With USTP St. Pölten, the University of Vienna, the FWF (project INODES), DIH Ost and KIRAS.

Research behind the game

Intro video · Background video · Game manual (PDF)