Skip to main content

Introduction to Comrades & Chollimas

What Comrades & Chollimas is, how a 90-minute session flows, what you will learn, and what to expect in your first session.

Incident response is a team sport, and most training makes you do it alone. Comrades & Chollimas puts you at a table with the people you would call in a real incident and gives you one problem: a new remote hire starts Monday, and one of the three candidates may be an operator’s persona.

The philosophy

Learning through discovery

  • Your knowledge drives the content. The Incident Master (IM) leads and keeps the clock, but what you notice and what you decide create the session.
  • Questions matter more than answers. A good question to a hire, a payee or a log beats a confident guess.
  • Mistakes become insights. A wrong accusation costs something on the board, and the debrief turns that cost into learning. It is part of the game, not a failure of the player.
  • Collaboration creates confidence. HR, Engineering, SecOps and Finance & Legal each hold part of the picture. Nobody can solve it alone.

Learning over winning

Both sides end the session reading the same two facts: was the operator cut, and what was the final Payoff. There is no single winner. After those, a separate check asks whether your process held: did every cut rest on a named control or a human cost, rather than on looks alone? Winning and judging well are different things, and the second is the one you take back to work.

The case

A case file holds 3 hire cards. Every card has the same fields: role and start date, work pattern, process facts (ship-to address, remote tools, ID-check status) and money facts (payee, bank changes). There is no portrait, no accent or language field, and the names come from one mixed list.

One of the 3 is the operator’s persona. The other two each carry 2 weak oddities, one process and one money, each with a harmless reason, such as a late bank change or a shy camera. Everything you can learn about a hire comes from behaviour, process and money. A clue is a fact on a hire’s card that has been revealed by a lookup, a successful inform action, a Probe-interview or a meeting answer. A cut needs 2 clues of 2 different types, so nobody can be cut before stage 2.

NoteSay persona, not nationality

The game talks about a persona, an assessed or suspected operator, and the people who stand behind it, who may be a subcontracted freelancer or hidden entirely. It does not say where anyone comes from, and it does not claim anyone is coerced. Attribution in the real world is “assessed” or “suspected”, and your table should say it that way too.

How a session works

The basic structure

A session targets 90 minutes (DEFAULT): setup 10, then 3 stages of 15, transitions of 5, a 20 minute debrief, and 10 of slack.

The Interview. The first stage. References, a first call, a start date. Can the Company tell who applied?

Onboarding. The second stage. A laptop ships, accounts open, a bank form arrives. Do the checks happen before access, or after?

The First Month. The third stage. Access spreads, a remote tool nobody approved appears, and the first pay run closes. What can the hire now reach?

Each stage is 2 rounds. In a round the IM reveals the clue tier and any event, the table talks, and the best-fitting role acts. How a Round Works walks through one.

Your role in the team

You do not play a generic security professional. You hold one of eight roles, four per chair, and each role has three verbs. Every role verb costs one action. You can also Ask, Look and Hold for free. See Chairs and Roles.

Two tracks you can both see

Payoff is the Comrades’ progress toward the case’s mission: wages, data or IP, or keys the hire can reach. Exposure is the harm the Company has caused itself or let slip. Both are on the table where everyone can read them, and both run from 0 to 9. See Tracks, Evidence and the Bench.

Stop the line

Any player on either side can stop the line and call for a vote on which hire is the suspect. It costs both tracks, the cost is paid at the call, and the call is spent even if nobody ends up accused. Use it when you can say why. See Stop the Line.

What the game teaches

Every mechanic stands for something you do at work:

  • The clue tier (noisy, partial, clean) teaches that the same evidence is harder or easier to read depending on how many checks you have already done.
  • The named-control rule teaches that “we should block them” needs “because this control was missing”.
  • The lookup budget teaches that questions to a hire and log pulls cost time, so you choose them. Each one also makes the evidence easier to read for everyone.
  • Stop-the-line teaches that acting too early on a hunch has a price, and so does acting too late.
  • Both chairs teach what a hiring process looks like from the other side of the screen.

A safe environment for growth

  • Ask questions without feeling inexperienced.
  • Make mistakes and learn from them as a group.
  • Share knowledge and learn from other disciplines.
  • Practice communication across technical and business backgrounds.
  • Step out at any time. The IM will pause for anyone who is uncomfortable, no reason needed.

What to expect in your first session

  1. The IM reads a brief (under 3 minutes, no DPRK background needed) and assigns chairs and roles. Chair sheets come after.
  2. The IM explains the d20, the two tracks and stop-the-line.
  3. The IM plays round 1 as a taught round, naming each step as it happens.
  4. You play the remaining rounds, then debrief together. In the debrief you unseal the persona, replay your accusations, and each write one control your real organisation lacks.
TipNobody expects you to know DPRK background

The case brings what you need. Your job is to read the file, ask good questions and act as your role. Real-world knowledge from your job helps, and gaps do not hurt.

What next