Play to learn Elevation of Privilege

Play to Learn Elevation of Privilege

This is a unique opportunity to take part in an Elevation of Privilege game, guided by the game's creator and threat modelling expert, Adam Shostack. Working remotely in a small group, you’ll use the game to identify potential threats within a system architecture.

It’s a great opportunity for teams wanting practical experience with Elevation of Privilege, while developing the skills and confidence to introduce the technique to colleagues or clients. This is a paid session, with pricing agreed based on the size of your team.

Format overview
- Facilitator: Adam Shostack
- Support: Cybersec Games team provides logistical support and co-facilitation
- Scorekeeping: A dedicated scorekeeper will track game progress and tally points
- Duration: 1.5 hours
- Platform: Zoom (link provided ahead of the session)
- Group size: Teams of 5 to 7 players
What's included?
Each participant will receive a training pack by post.
- A physical Elevation of Privilege card deck
- A training exercise authored by Adam Shostack
The training exercise outlines a detailed scenario complete with enough information to construct a system architecture diagram.
Participants are encouraged to sketch their own versions beore the session, a valuable exercise in its own right.
How the session works?

Before the session, our Croupier app deals a set of random hands. The players selects their hands from their deck in preparation for the game.
The 1.5-hour session is hosted on Zoom and facilitated by Adam, who guides the group through each stage. Participants use digital tool (e.g. MIRO) to collaboratively sketch a system architecture diagram.
The game begins with players taking turns identifying potential threats, discussing associated risks, and capturing key insights.

After the session

Team leads can optionally arrange a follow-up call with Adam. This is a great opportunity to:

Ask further questions
Discuss how to adapt and embed the game within your own team’s workflow
Receive advice on advancing your threat modelling practice

Interested in running a session?

If you're thinking about bringing this session to your team, drop us a line. We're happy to chat about what you need, talk through possible dates, and help figure out if it's the right fit.