Play to learn: Elevation of Privilege

This session is your teams' chance to see Elevation of Privilege in action, understand the thinking that makes it effective, and leave with practical ideas for bringing it into your own team. In 90 minutes, you’ll experience how the game turns threat modelling into an engaging, collaborative process that creates conversations and uncovers real security insights.

Why teams use Elevation of Privilege?

Elevation of Privilege works because it gives everyone a way into the conversation.

Developers understand the system. Product owners understand business impact. Testers think about failure. Security teams bring specialist knowledge. The game gives all of them a shared structure for discussing risk.

Creator led session with Adam Shostack

We are very excited to collaborate with Adam Shostack, creator of Elevation of Privilege, to deliver selected sessions giving teams the opportunity to learn directly from one of the leading practitioners in threat modeling.

Ask about a session with Adam

Overview
- Facilitator: CyberSec Games or Adam Shostack
- Duration: 90 minutes
- In-person or Zoom
- Group size: Teams of 5 to 7 players
- Session materials (included in the price): For both virtual and in-person sessions, each player will receive an EoP deck, a training exercise and a copy of the system architecture diagram.
Before the session

For virtual sessions, random card hands are generated using the online Croupier tool and emailed to players ahead of the session. Players pick out their cards from their deck before we start.
Scorekeeping: Either someone from CyberSec Games or a nominated team member keeps score. If it’s a client team member, we'll provide a short pre-session briefing.
Session details

The session begins with a short introduction to Elevation of Privilege and the AWS architecture scenario we’ll be using.
Then we jump into live gameplay: players take turns applying their cards to the scenario, identifying threats, discussing risks, and capturing insights.
We finish with a group discussion on what we observed and practical ways to introduce EoP into your own teams.

After the session

Team leads can optionally arrange a follow-up call. This is a great opportunity to:

Ask further questions
Discuss how to adapt and embed the game within your own team’s workflow
Receive advice on advancing your threat modelling practice

Interested in booking a session for your team?

If you're thinking about bringing this session to your team, drop us a line. We're happy to chat about what you need, talk through possible dates, and help figure out if it's the right fit.