A preparedness exercise in half a day
Exercise crisis management
without building the exercise first
Motstandskraft is a free preparedness simulation where the group runs a country from 2026 to 2040: allocating the budget, hardening the infrastructure and taking the decisions when the crises interrupt. Eight ready made scenarios, no preparation, no groundwork.
Free. Runs in the browser, no installation. No account needed to try it.
What the group actually practises
Three things that are hard to exercise any other way
-
Deciding under uncertainty
Some crises pose the attribution question before the investigation is finished: accuse early or hold back, at the risk of being wrong either way. It is the hardest skill in crisis management and the only one you cannot read your way to.
-
Valuing what is never seen
After every crisis the shadow account is shown: the damage the investments averted. It gives a leadership team a language for justifying what otherwise never turns up in any follow up.
-
Prioritising under scarcity
Three of the eight sectors are visible to voters, five are not. What keeps the country running through the crises is mostly what voters never see. The same tension as a security budget against a quarterly report.
In reality no such account exists: averted damage does not show up in any follow up, and that is the very reason preparedness is hard to fund. The shadow account is therefore not realism, it is the point.
From the simulation
What it looks like
The map, a crisis decision, a real time response and the final screen. Click to enlarge.
-
The map with facilities, situational picture and budget sliders -
A crisis decision with options and consequences -
The real time response while something is under way -
The final screen with grade and shadow account
In practice
How to turn it into an exercise
The audience is groups: crisis management teams, training rooms, courses. The team function lets one such group compare itself with another without anyone having to share an account.
- 01
Create the team
The team leader creates a team and invites the group with a share link or by email. The invitation code is valid for seven days. - 02
Everyone plays one round each
In exercise mode, whenever it suits each person. Time runs more slowly and every warning waits until it has been read and acknowledged. - 03
Compare in the team view
Average score, preparedness level and which crises the group actually met. Teams are ranked on the average per active member, so a large team gains no advantage from being large. - 04
Talk about the decisions
Who prioritised the invisible, who accused too early, what it cost. This is where the exercise gives you something.
Ready made material
Eight scenarios to choose from
Every scenario has a standardised starting position, a guaranteed crisis and a built in debrief. No facilitator guide needed.
- 1
Monday morning
The introduction. 200 municipalities without systems. - 2
The care chain
When the medical records system cannot be trusted. - 3
Blackout
The power supply and everything hanging on it. - 4
The deep
Cables and pipelines on the seabed. - 5
The network
Communications when the emergency services need them most. - 6
False images
Influence operations when they are hardest to counter. - 7
Grey zone
The hardest scenario. Everything at once, nothing proven. - 8
The flow
The supply chain and the dependency on a single supplier.
The scenarios earn their own exercise badges but never count towards records or the leaderboard. They exist in order to teach.
Credibility
The crises have real world models
The fact box after every decision names the real world model. The requirements of the Swedish Cybersecurity Act sit in the mechanics themselves, not in a text box off to the side.
- NotPetya, 2017. Malware spread through an update to Ukrainian accounting software and then globally. The shipping company Maersk had to rebuild large parts of its IT environment.
- The Ukrainian power grid, 2015 and 2016. Attackers remotely operated breakers and cut power to hundreds of thousands of customers.
- SolarWinds, 2020. A backdoor distributed through signed software updates to thousands of organisations, undetected for months.
- Viasat KA-SAT, 2022. Satellite modems were knocked out across large parts of Europe in the same hour the invasion of Ukraine began.
- The Slovak election, 2023. A manipulated audio recording of a party leader spread in the days before the election, during the campaign silence when it was hardest to counter.
- Balticconnector and the Baltic Sea cables, 2023 to 2025. Damage to a gas pipeline and data cables where investigators struggled to separate negligence from intent.
- CrowdStrike, 2024. A faulty content update knocked out millions of Windows systems within hours. Airlines, hospitals and public authorities stood still without anyone having attacked.
- Miljodata, August 2025. Ransomware at the IT supplier to Swedish municipalities affected more than 160 municipalities and around 1.5 million personal records.
The crises are moved in time, place and scale. The game deliberately names no attacking states and the tone is factual: the simulation wants to show how preparedness works, not to frighten. Every simplification made is set out openly on the game page "About the model".
A decisive insight for anyone taking on information security is that it is not about making yourself invulnerable. No organisation, whatever its size or resources, can guarantee it will never be attacked. Resilience, the ability to withstand, adapt and recover, is the real goal.
The book is the depth, the simulation is the exercise. Read about the book
Motstandskraft is an independent product from VER&IT AB. It is not published by, and not produced on behalf of, any public authority.
Common questions
Before you book it in
Is an account required?
No, not in order to play. The team function and the leaderboard require a free account with a verified email address.
How long does a round take?
Count on 30 to 45 minutes in exercise mode. A round covers 180 months, and most of the time goes on reading and deciding, not on waiting.
Does it cost anything?
No. The game is free to use.
Does it work on a tablet and a phone?
Yes. Below 900 pixels wide the crises appear as a panel at the bottom instead of beside the map.
May we use it on a course or in internal training?
Yes. The game is built as an exercise tool and may be used in training, workshops and leadership team exercises.
Where does the content come from?
The crises are based on real incidents and the map data is Natural Earth, which is public domain. Every simplification made is set out on the game page "About the model".
Is it a government product?
No. Motstandskraft is an independent product from VER&IT AB. It is not published by, and not produced on behalf of, any public authority.
Are participants tracked?
No. The game has no tracking and runs in the browser without installation.
A plan that has never been exercised is a hypothesis.
Play nowBe first
Keep up with the book
Sign up and we will be in touch when the Toolbox grows and when something happens around the book.
A first name and an email address is all it takes. No self-assessment required, no noise, and you can unsubscribe at any time. Please note that the book is written in Swedish.
Thank you, you are on the list. Check your spam folder if the confirmation is slow.