Last Sunday, I tried to answer a simple question: Why this? Why now? Just... why?

Five days later, I've got a castle, five characters, a soundtrack, a movie storyboard and 128 commits since this adventure began.

And a growing suspicion that I've seriously underestimated what I've got myself into.

First, I promised you a bard.

An old friend, Deejay Nic, joined the adventure and together we created Glitch In The Matrix, the official AttackPathMan soundtrack.

Then I spent an unreasonable amount of time making a teaser fit exactly 117.96 seconds of music.

Apparently, creativity now comes with decimal places.

You can hear the result at attackpathman.com.

Then things got a little out of character.

Or rather, entirely into character.

What started as a few ideas turned into five personalities, complete with concept art, cartoon sprites and RPG cards.

Some look heroic. Others look suspiciously like people who would schedule a meeting to discuss why the castle is on fire.

(opens the full-size picture)

I even had four AI sessions working in parallel to bring them to life.

Which brings me to another discovery.

Managing AI agents is remarkably similar to managing people.

They misunderstand instructions, occasionally invent things, and can spend an impressive amount of time agreeing with each other.

Unlike people, they can be wrong at industrial speed.

We even discovered that one of our automated tests was confidently reporting successful downloads when the downloads hadn't actually completed.

The AI had tested the test. The test had passed.

The file, unfortunately, hadn't.

An independent review eventually caught it.

Lesson learned: four confident AI agents don't necessarily make one correct answer. Sometimes you've just automated a committee.

And somewhere along the way, I changed my mind.

The original direction was too constrained by reality. I wanted room for creativity without inventing facts about real people or organisations.

So I rewrote the brief, reconsidered the story and gave the fictional world permission to be fictional.

Quite liberating, actually.

Which brings us to today.

A week of writing, designing, experimenting, reviewing and occasionally questioning my life choices.

There's something wonderfully ironic about creating a cybersecurity adventure and discovering that the biggest attack path so far runs straight through my own assumptions.

Still, I'm enjoying every minute of it.

The castle has inhabitants. The bard has delivered. The AI committee is under supervision.

And as for what awaits behind the castle gates?

Well, where's the fun in giving away the adventure before you've even started?

Until the next adventure,

Kay

P.S. The castle now has a Head of IT. Nobody knows what he does yet, but I'm told he's very senior. So that's reassuring.

It’s Cybersecurity Awareness Month. It’s also my birthday month, and I’ve decided to mark the occasion by becoming a game developer.

I have a name, a website and a growing list of things I don’t yet know how to do. By the standards of most adventure games, I appear to have everything I need.

Welcome to AttackPathMan.

Before we get to the game, I should probably explain myself. Announcing a cybersecurity adventure game does invite a few questions, including the entirely reasonable one in the title.

For me, this starts somewhere quite personal.

I left the creative world behind because I thought there was no longer room for it. Other work took that space, and somewhere along the way I accepted that creating things belonged to an earlier chapter.

Finding my way back through game development was never part of the plan. Frankly, neither was having a plan that required me to think seriously about what a small pixelated person should do when confronted with a suspicious door. Yet here we are.

And it feels good to be creating again. Better than I expected.

There is room for that part of me after all. I suspect quite a few people have a part of themselves they would like to make room for again.

Somewhere along this adventure, I picked up the phone and called my old friend Deejay Nic, from that former creative life. More on that in the next post. When he heard the idea, he lit up like we’d just found the Holy Grail in the 1989 adventure Indiana Jones and the Last Crusade. Fortunately, this required considerably less crawling through catacombs.

There was that familiar spark again. Hearing it in an old friend made finding my own way back feel even better.

Nic is making all the music for the game, and we’ve also written an actual song together, which we’ll be releasing soon. Apparently, a slightly unreasonable idea can be contagious. The party is growing, and it now has a soundtrack.

AI is a large part of why I can take this step now. Technical barriers that once put an idea beyond my reach are becoming easier to work through. I can try something, see what happens, learn from it and keep going.

There is still plenty to learn, test and get wrong. I remain responsible for deciding whether any of it is good. That particular task has stubbornly refused to disappear.

But more of my time can go towards the questions that made me want to create something in the first place. What should this feel like? What might make someone curious? What do I want them to understand when they leave?

As execution becomes more accessible, I see room for more people to make things they had already ruled out. People with ideas, experience and something to say, who previously faced a very long journey between thinking of a thing and being able to make it.

Our time is still the most valuable thing we can offer. Having more ways to spend it shaping an experience is a possibility I’m very glad to have back.

Which brings us to the other question.

Why spend that time making this?

Because I want to help people understand why attack paths matter more than hunting vulnerabilities and weaknesses in isolation.

There. I said it. I shall now remain perfectly still while the comment section acquires a chair.

Fixing vulnerabilities matters. So does understanding how someone could connect access, permissions, identities and trust to reach something we care about. Looking at each weakness separately can leave us with a very incomplete picture of what is possible.

A person has access to one place. From there, they can reach another. A system trusts that person, and another system trusts the first. Each arrangement may have a perfectly sensible explanation. Together, they can create a route nobody intended.

The castle has excellent walls. Unfortunately, someone wearing a familiar hat has been waved through three doors and offered a biscuit.

That relationship between individual decisions and their combined consequences is what interests me. Who can become whom? What can they reach next? Where could we interrupt the journey? What would make it too difficult, too expensive or simply no longer worthwhile?

These questions affect people far beyond the security team.

Most people don’t need to understand the OSI model to use the internet. They shouldn’t need a security background to recognise how someone can borrow their credibility, exploit their trust or use their relationships against them.

We ought to be able to help people understand that without first issuing them a reading list and a small qualification in acronyms.

A whitepaper reaches the people who find the time to read it. Good research deserves that time, but we cannot make understanding this problem conditional on reading our research.

A podcast would reach some people. Another round of posting and reposting on LinkedIn would reach others. I’ve spent enough time there to know that a strongly worded paragraph can travel quite some distance before anyone agrees what it meant.

I want to try a different way in.

Games give us a chance to make decisions and discover their consequences. We can follow our curiosity, misunderstand something, try again and gradually notice how the pieces fit together.

There is something satisfying about the moment a puzzle makes sense. The clues were there, but suddenly you understand their relationship. You can explain why the solution works.

That is the kind of understanding I want AttackPathMan to help create. Something people can experience for themselves and carry back into the world afterwards.

Whether I can make that work is part of the adventure. It would be convenient if announcing a game also completed its development, but I have checked and apparently there are further steps.

I’m deliberately separating this project from my day-to-day role. I want it to have its own voice, and I want people to be able to engage with its ideas without wondering whether every door eventually opens onto a product demonstration.

Understanding what makes an attack possible, worthwhile or too costly to pursue goes well beyond tooling. We have to understand why our approach needs to change before debating how to change it and what to buy.

There are no easy answers or universal doctrines here. The problem deserves a proper look before we start handing out solutions.

I’m grateful to SpecterOps for valuing community impact and giving me the freedom to pursue this on my own terms. Having the space to explore an idea like this means a great deal.

Today, I’m launching the website. The game is still in development, and I’ll be sharing what I’m making, what I’m learning and the occasional decision that seemed entirely sensible at the time.

This will also be a home for my writing. A place to put the thoughts I keep returning to, the things I’m trying to understand and the questions I think deserve a longer conversation. Some will connect to the game. Others may wander off through a side door and return several posts later carrying something nobody remembers asking for.

Some of those thoughts may be uncomfortable. I’m happy to question things, and I expect to have my own thinking questioned in return. “How appropriate. You fight like a cow” is a perfectly respectable opening, although I may ask you to expand on your argument.

More is coming this month. Some of it may look, and sound, very different from what you expect.

For now, meet AttackPathMan.

If this helps even a little to turn awareness into readiness, it will have been worth the effort.

And if you’ve also been wondering whether there is still room for the creative part of you, I hope you find a way to make some.

Thanks for being here at the beginning.

Kay

P.S. If a suspicious-looking character asks you to hold something while they speak to the castle administrator, perhaps establish why they need your hat first.