Earl CraneThe Balanced Attacker Model, or BAM, card deck is a cybersecurity training and risk management tool designed to help teams think critically about threats, assets, controls, and tradeoffs.
The deck includes 10 attacker cards, 18 asset cards, the 23 NIST Cybersecurity Framework categories, and six risk categories. It helps organizations explore key cybersecurity concepts including threat modeling, loss scenario iteration, tradeoff analysis, risk appetite, resource scarcity, risk management, resiliency, layered defense, defense-in-breadth, and defense-in-depth.
BAM is well suited for cybersecurity leadership workshops, governance and risk discussions, tabletop exercises, and in-house security training. Brand-customized decks are also available for organizations that want to use BAM as part of their internal cybersecurity or risk management program.