02:00. The log will not stop scrolling.

One of those lines is an attack.

SEC//SIM is a detection-and-response roguelite in which you work one night as an analyst in a security operations centre. It is not a game about breaking in. It is a game about reading an attack, and cutting it.

■ Hunt. Deduce. Contain.

A shift is three motions.

Hunt Click a suspicious line in the flood to flag it. Follow it by eye, or press / and narrow the river with grep — regular expressions supported.

Deduce Dive into focus mode. The world slows down and you get time to think. Inter-arrival variance (a z-score), entry path, cause, business impact. "Variance near zero = machine, not human." The C2 beacon gives itself away.

Contain Choose your response. Cut surgically, firewall the C2 address only, or take down the whole /24. The choice changes the outcome: the wider you block, the safer you are — and the more uptime and trust you burn.

Every shift is scored on MTTR, SLA uptime, and detection F1. The metrics you are graded on are the metrics a real SOC is graded on.

■ The attacker adapts to you

Ten attacks — reconnaissance scanning, credential stuffing, SQL injection, XSS, L7 DDoS, phishing, valid-account abuse and lateral movement, C2 beaconing, exfiltration, ransomware — all mapped to MITRE ATT&CK, OWASP, and NIST.

And the attacker learns. Block it with a signature and it returns obfuscated the next night. Fix the root cause and it does not return at all. The difference between a patch and a cure shows up tomorrow.

At the top of the map waits the APT campaign "Silent Intruder": a loud diversion and a quiet real objective, running at the same time.

■ A low floor and a very high ceiling

A newcomer can solve a shift by picking from the suggested responses.

A practitioner can read the structure of the log directly and solve it far faster, far cheaper, and far more cleanly. Both are driving the same simulation underneath — the only difference is the score and the clock. Improvement is one continuous slope, not two games.

Techniques you have mastered get automated away (SOAR starts handling them unattended), so the board in front of you never settles into busywork.

■ One night ends. There is always another.

Campaign Climb night by night toward the APT. Draft a different loadout every run.

Endless The threats never stop, and they start arriving together. How long do you hold?

Daily Everyone gets the same seed. Same flood — whoever handles it cleanest wins.

Lab Study one technique with no clock and no consequences.

Every technique you beat is registered in the ATT&CK codex along with your own response record. There is a skill tree, a shop, and a career ladder (Intern → L1 → L2 → Responder → Hunter → Lead → CISO). Every reason to come back is inside the board.

■ How it feels to play

· Fully playable from the keyboard alone. Key rebinding included.

· Severity is distinguished by shape (▲▲ / ▲ / ●) as well as colour, with a colour-blind-safe pattern mode.

· Focus mode's slowdown is adjustable in settings, for players who do not want the rush.

· Japanese and English, switchable instantly.

· Entirely offline. No account, no connection, no server.

There is no stamina. Nothing refills on a timer.

There are no loot boxes, no gacha, and no in-app purchases.

What you get instead is the feeling of getting better at it.

■ Yes, this is practice

The mechanics are modelled on real blue-team work: log analysis, SIEM triage, finding IOCs, reconstructing a kill chain, making a containment call, detection engineering. Playing well and working well were designed to point in the same direction.

That said, this is a game, not a certification and not courseware. "Because it is fun" is a perfectly good reason to get good at it.