Presumption Deck for Malware & Monsters
Description
Description
A physical card deck for Malware & Monsters that helps incident-response teams explore confidence, assumptions and decision-making under uncertainty.
Designed by Klaus Agnoletti for use with Malware & Monsters.
Bulk Pricing
Bulk Pricing
Automatically applied at checkout:
| Buy | Discount |
|---|---|
| 5 or more decks | 5% off |
| 10 or more decks | 10% off |
| 20 or more decks | 15% off |
| 30 or more decks | 20% off |
Presumption Deck for Malware & Monsters
Specifications
Specifications
-
SuitsType ID, Confidence, Severity, Resource
-
# Cards
-
Created by
What is Presumption?
During a Malware & Monsters scenario, teams have to make decisions with incomplete information. Presumption makes those judgements visible.
Players commit their assessment, their confidence and eventually their resources before the outcome is revealed. That creates a powerful discussion afterwards: not only were we right?, but how sure were we, and was that confidence justified?
The Presumption cards help teams explore how they communicate uncertainty, how group confidence forms, whether assumptions are being challenged, how evidence influences decisions, and what happens when a team is confident but wrong.
What's in the deck?
The Presumption Deck adds four sets of voting cards to any Malware & Monsters scenario. Each decision comes from a fixed set of options, cutting through vague answers and hedging:
- Type ID (9 cards) - nine threat families, including Trojan, Ransomware, Phishing and Unknown.
- Confidence (3 cards) - Confident, Probable or Uncertain. How sure are you?
- Severity (6 cards) - from Contained Spark to Extinction Event, plus Can’t Call It.
- Resource (7 cards) - the response effort required, from a Focused Round to Unknown Scope.
How does it work?
Every vote follows three steps. CALL: the facilitator asks the question and opens a short discussion. COMMIT: everyone places their chosen card face down. REVEAL: all cards turn over together, exposing agreement, or a useful split in judgement.
Votes take place at three points in the scenario: Identification, Containment and Response. Confidence is played once, alongside Type ID during Identification, creating a clear calibration signal without slowing down every decision.
The important part is committing before seeing anyone else’s answer. The cards make this quick and tactile, but the same method also works with answers written on folded paper or sticky notes.
