How to play Backdoors & Breaches online
Backdoors & Breaches is a tabletop incident-response game from Black Hills Information Security. A crew of defenders faces a hidden attack chain and has to find the right procedures before the clock runs out. B&B Shuffle is a free, unofficial companion that deals the cards, tracks turns and strikes, and lets a group play the same session from different rooms.
What you need
- Two to six defenders and one Incident Master (the GM).
- A d20 – or just use the roller on the player board.
- A browser. No account, no install and no payment.
- Optionally, the physical game for the printed cards and rule book.
The attack chain: four cards
The Incident Master lays out four attack cards face-down: Initial Compromise, Pivot & Escalate, C2 & Exfiltration and Persistence. Each one hides a specific technique. The defenders can see that an attack happened in each phase, but not which technique was used – that is what the investigation has to uncover.
Your hand: procedures, injects and consultants
- Procedure cards are the defenders' tools. Each lists the attack phases or techniques it can detect, plus its TOOLS and DETECTION text.
- Inject cards are complications. The GM plays one when the crew fails a roll, stalls, or the story needs a push.
- Consultant cards are specialists who add help, abilities or a one-off effect to the team.
A turn, step by step
- The Incident Master frames the scene. The crew agrees on a Procedure and commits to it.
- Roll the d20 against the scenario's target – 11 by default in the app.
- 11 or higher succeeds. Read the procedure's detection, and flip any attack card it covers face-up.
- Below 11 fails. The turn is still spent, and the GM may play an Inject.
- A natural 20 is a critical success. A natural 1, or three misses in a row, draws an Inject.
- Use Turn when the round moves on. Three strikes ends the session; the board tracks turns and strikes for you.
Running a remote session
Put the player board on the shared screen, projector or video call, and keep the GM Console on the Incident Master's own screen. The console shows the answer key and can spend turns, apply strikes and push board updates, while the player screen keeps control of the dice animation and the turn record. When you are in the same room, the print sheet builds a paper copy of the cards in play.
Prepare ahead in the Scenario Editor, save or export the scenario, and open it from the Scenario Library. The demo ships with three scenarios, including a guided tour for first-time tables.
Playing solo against the AI Incident Master
Solo AI mode hides the attack chain and answers your investigations with clues. A successful procedure reveals a phase; enough successes name the technique. When you think you know all four cards, make an accusation – a wrong accusation costs a strike. The mode works with a configured AI provider, and falls back to built-in offline clue tables when no provider is available, so the game stays playable without an API key.
Browsing the cards
The card catalogue shows every deck loaded by the app – Core, Core 3.1, ICS-OT, the sponsor expansions and the MEGA deck – with card faces, text, TOOLS and DETECTION sections.
Frequently asked questions
Is B&B Shuffle free?
Yes. It is free and open source under the GPL-3.0 licence, with no account or payment. The public demo is read-only: scenarios you edit exist only in your browser until you reload.
Do I need the physical Backdoors & Breaches game?
No. The demo ships with decks and scenarios, so you can play a full session in the browser. Owning the printed game helps if you want to run it alongside the app.
Can I play Backdoors & Breaches remotely?
Yes. Share the player board, keep the GM Console on a second screen, and roll in the app so every player sees the same result.
Is B&B Shuffle affiliated with Black Hills Information Security?
No. Backdoors & Breaches is published by Black Hills Information Security and Antisyphon Training. This is an unofficial community project, not affiliated with, endorsed by or sponsored by either company.
How many players does a session need?
A typical table is two to six defenders plus one Incident Master. Solo AI mode plays the Incident Master when you are on your own.
Does the app work on a phone or offline?
The player board has a compact landscape layout for phones and tablets, and the site is a PWA, so the player shell can load from cache after a first visit. Card images and scenarios still need a connection the first time.
Can I make my own cards and scenarios?
Yes. The Scenario Editor builds scenarios, and the Card Creator designs custom cards and exports them as PNG, SVG or JSON. On the public demo, custom cards stay in your browser.