Threats descend from the Untrusted zone up top. Place security controls on the Conduit to stop them, and protect the Essential Services Core at the bottom.
① Tap a ⊕ slot beside the pipeline to place a control ② Combine Firewall · IDS · Segmentation for defense in depth ③ Defeat threats → earn budget → reinvest in upgrades ④ Survive 10 waves = Cyber Resilience verified
What each mechanic maps to
Conduit pipeline
The communication path between Zones. A color change marks a Zone boundary.
Zone (Cat I/II/III)
System groups by criticality. Closer to the Core = higher category.
Security control (Tower)
Firewall · IDS/IPS · Segmentation — controls used to meet SL-T.
DMZ
The IT–OT boundary. Miss it here and threats reach OT.
Core Integrity
Falls when Essential Services are breached — 0 means a cyber incident.