Why this? Why now? Just... why?
Dear adventurer,
It’s Cybersecurity Awareness Month. It’s also my birthday month, and I’ve decided to mark the occasion by becoming a game developer.
I have a name, a website and a growing list of things I don’t yet know how to do. By the standards of most adventure games, I appear to have everything I need.
Welcome to AttackPathMan.
Before we get to the game, I should probably explain myself. Announcing a cybersecurity adventure game does invite a few questions, including the entirely reasonable one in the title.
For me, this starts somewhere quite personal.
I left the creative world behind because I thought there was no longer room for it. Other work took that space, and somewhere along the way I accepted that creating things belonged to an earlier chapter.
Finding my way back through game development was never part of the plan. Frankly, neither was having a plan that required me to think seriously about what a small pixelated person should do when confronted with a suspicious door. Yet here we are.
And it feels good to be creating again. Better than I expected.
There is room for that part of me after all. I suspect quite a few people have a part of themselves they would like to make room for again.
Somewhere along this adventure, I picked up the phone and called my old friend Deejay Nic, from that former creative life. More on that in the next post. When he heard the idea, he lit up like we’d just found the Holy Grail in the 1989 adventure Indiana Jones and the Last Crusade. Fortunately, this required considerably less crawling through catacombs.
There was that familiar spark again. Hearing it in an old friend made finding my own way back feel even better.
Nic is making all the music for the game, and we’ve also written an actual song together, which we’ll be releasing soon. Apparently, a slightly unreasonable idea can be contagious. The party is growing, and it now has a soundtrack.
AI is a large part of why I can take this step now. Technical barriers that once put an idea beyond my reach are becoming easier to work through. I can try something, see what happens, learn from it and keep going.
There is still plenty to learn, test and get wrong. I remain responsible for deciding whether any of it is good. That particular task has stubbornly refused to disappear.
But more of my time can go towards the questions that made me want to create something in the first place. What should this feel like? What might make someone curious? What do I want them to understand when they leave?
As execution becomes more accessible, I see room for more people to make things they had already ruled out. People with ideas, experience and something to say, who previously faced a very long journey between thinking of a thing and being able to make it.
Our time is still the most valuable thing we can offer. Having more ways to spend it shaping an experience is a possibility I’m very glad to have back.
Which brings us to the other question.
Why spend that time making this?
Because I want to help people understand why attack paths matter more than hunting vulnerabilities and weaknesses in isolation.
There. I said it. I shall now remain perfectly still while the comment section acquires a chair.
Fixing vulnerabilities matters. So does understanding how someone could connect access, permissions, identities and trust to reach something we care about. Looking at each weakness separately can leave us with a very incomplete picture of what is possible.
A person has access to one place. From there, they can reach another. A system trusts that person, and another system trusts the first. Each arrangement may have a perfectly sensible explanation. Together, they can create a route nobody intended.
The castle has excellent walls. Unfortunately, someone wearing a familiar hat has been waved through three doors and offered a biscuit.
That relationship between individual decisions and their combined consequences is what interests me. Who can become whom? What can they reach next? Where could we interrupt the journey? What would make it too difficult, too expensive or simply no longer worthwhile?
These questions affect people far beyond the security team.
Most people don’t need to understand the OSI model to use the internet. They shouldn’t need a security background to recognise how someone can borrow their credibility, exploit their trust or use their relationships against them.
We ought to be able to help people understand that without first issuing them a reading list and a small qualification in acronyms.
A whitepaper reaches the people who find the time to read it. Good research deserves that time, but we cannot make understanding this problem conditional on reading our research.
A podcast would reach some people. Another round of posting and reposting on LinkedIn would reach others. I’ve spent enough time there to know that a strongly worded paragraph can travel quite some distance before anyone agrees what it meant.
I want to try a different way in.
Games give us a chance to make decisions and discover their consequences. We can follow our curiosity, misunderstand something, try again and gradually notice how the pieces fit together.
There is something satisfying about the moment a puzzle makes sense. The clues were there, but suddenly you understand their relationship. You can explain why the solution works.
That is the kind of understanding I want AttackPathMan to help create. Something people can experience for themselves and carry back into the world afterwards.
Whether I can make that work is part of the adventure. It would be convenient if announcing a game also completed its development, but I have checked and apparently there are further steps.
I’m deliberately separating this project from my day-to-day role. I want it to have its own voice, and I want people to be able to engage with its ideas without wondering whether every door eventually opens onto a product demonstration.
Understanding what makes an attack possible, worthwhile or too costly to pursue goes well beyond tooling. We have to understand why our approach needs to change before debating how to change it and what to buy.
There are no easy answers or universal doctrines here. The problem deserves a proper look before we start handing out solutions.
I’m grateful to SpecterOps for valuing community impact and giving me the freedom to pursue this on my own terms. Having the space to explore an idea like this means a great deal.
Today, I’m launching the website. The game is still in development, and I’ll be sharing what I’m making, what I’m learning and the occasional decision that seemed entirely sensible at the time.
This will also be a home for my writing. A place to put the thoughts I keep returning to, the things I’m trying to understand and the questions I think deserve a longer conversation. Some will connect to the game. Others may wander off through a side door and return several posts later carrying something nobody remembers asking for.
Some of those thoughts may be uncomfortable. I’m happy to question things, and I expect to have my own thinking questioned in return. “How appropriate. You fight like a cow” is a perfectly respectable opening, although I may ask you to expand on your argument.
More is coming this month. Some of it may look, and sound, very different from what you expect.
For now, meet AttackPathMan.
If this helps even a little to turn awareness into readiness, it will have been worth the effort.
And if you’ve also been wondering whether there is still room for the creative part of you, I hope you find a way to make some.
Thanks for being here at the beginning.
Kay
P.S. If a suspicious-looking character asks you to hold something while they speak to the castle administrator, perhaps establish why they need your hat first.