Blue Hour is a night shift. Something is already inside a small corporate network — two machines answer to someone else before you touch anything — and you have three minutes, four containments, and no idea which machines they are. The estate floats in front of you in 3D: a jump host, an identity server, a file server, a shared drive, laptops, remote access, object storage, and one machine drawn in gold — the backup vault. If the intrusion reaches the vault, the shift is over, because an intrusion that reaches your backups turns a detection problem into a recovery problem. It lives on the Cybersecurity Encyclopedia because that library keeps making one argument in different keys: evidence before action. This is the argument as a game.
How to play
There are exactly two verbs. LOOK pulls telemetry on one machine and tells you the truth about it for a few seconds — but you cannot watch everything at once. CONTAIN isolates a machine and stops the spread through it — and you only get four for the whole shift, so cutting off a healthy machine means you have spent one of them on somebody’s working night. Everything else is reading: machines ping when something happens nearby, and half the pings are noise. Alerts are only leads.
Tap a machine and choose, or drag to turn the estate; on a keyboard, L looks, C contains, TAB cycles machines, M mutes. When the clock runs out — or the vault falls — an after-action review scores the shift the way a good team would: whether every containment landed on a genuinely compromised machine, how much of your telemetry budget you actually used before acting, and how far the blast radius spread. Each line of the review links into the encyclopedia’s guidebooks, so the game hands you straight back to the reading it came from.
What the shift actually tests
The intrusion moves the way lateral movement moves: along the network’s real edges, from the machines it holds to the machines they connect to. That is why the estate’s shape matters more than any single alert — the jump host and the identity server are worth more worry than a finance laptop, not because a scoreboard says so, but because more paths run through them. Blast radius is a shape, not a number.
The alerts are honestly unreliable on purpose. Half of them fire on healthy machines, and the real ones often fire next door to the event rather than on it — that gap between an alert and a fact is where the job actually lives. LOOK closes the gap, but it costs attention; CONTAIN closes a path, but it costs one of four and possibly a colleague’s uptime. The whole discipline the game rewards is the one its own after-action review names: isolations spent only on machines that were genuinely compromised, telemetry pulled before anything irreversible. Containment is never free.
How it was built
Blue Hour is hand-written WebGL and JavaScript — no engine — and it existed once before in a wordier form. The commit that produced the current cabinet says it plainly: “remade in WebGL with two verbs instead of thirty.” Everything the old version said with menus, this one says with a dark room, nine labelled machines, and a countdown; the design bet is that two verbs and a visible network teach triage judgement better than thirty verbs and a wall of text ever did.
The defensive framing is structural, not a disclaimer stapled on. The estate is fictional, there are no exploit steps and no malware anywhere in it, and the game never shows you how the intrusion got in — only how it spreads and what it costs to stop. The attacker in Blue Hour is weather. You are the only person on the shift with a decision to make, and the game is entirely about how you make it: look first, act once, and keep the gold machine dark.