Every defence and every threat, with the stats the simulation actually runs on. Threat numbers are the wave-one baseline; health and bounty scale up as a run progresses.
Stateful packet filtering. Cheap, fast, and always the first thing you stand up. Struggles against hardened payloads.
Signature-based scanning with a quarantine burst. Clears clustered, low-health swarms faster than anything else.
Intrusion detection. Reveals stealthed threats in range and flags what it hits so every other tower hurts more.
Forces every packet through a crypto handshake. Low damage, but the throughput penalty stacks up across a whole lane.
A deliberately soft target. Pulls threats toward it, poisons them slowly, and turns every kill nearby into extra budget.
Endpoint agents sharing telemetry. A detection on one host propagates to its neighbours, arcing between clustered threats.
Analysts feeding targeting data to everything around them. Deals no damage itself, and makes every neighbour hit harder and faster.
A model that learns the target it is shooting at. Slow, expensive, enormous range, and it ramps up the longer it stays locked on.
| Threat | Health | Speed | Armour | Core dmg | Bounty | From wave |
|---|---|---|---|---|---|---|
Virus Self-replicating code riding a host file. The baseline nuisance: no armour, no tricks. | 55 | 1.5 | 0 | 1 | 9 | 1 |
Worm Propagates on its own across the network. Fast and fragile, and it never comes alone. | 38 | 2.6 | 0 | 1 | 7 | 2 |
Phishing Payload A convincing lure clicked by a real user. Almost no health, but it sprints for the core. | 26 | 3.2 | 0 | 1 | 6 | 3 |
Trojan Hides inside something you asked for. Lightly armoured, so chip damage bounces off it. | 110 | 1.2 | 2 | 2 | 14 | 4 |
Ransomware Encrypts everything it touches. Slow, heavily armoured, and devastating if it reaches the core. Needs burst damage, not chip damage. | 260 | 0.85 | 6 | 3 | 32 | 5 |
Cryptominer Does not want to break anything. It wants your compute, and it drains budget every second it survives. | 130 | 1.3 | 1 | 1 | 20 | 6 |
DDoS Packet Volumetric flood traffic. Individually trivial, collectively overwhelming. Bring splash damage. | 20 | 2.2 | 0 | 1 | 2 | 7 |
Botnet Node A command-and-control hub. Killing it scatters the bots it was coordinating. | 190 | 1 | 3 | 2 | 24 | 8 |
Zombie Host An orphaned bot with no controller left. Only appears when a botnet node is destroyed. | 30 | 1.9 | 0 | 1 | 3 | — |
Rootkit Operates below the OS. Completely invisible, and untargetable, until a detector lights it up. | 150 | 1.15 | 4 | 2 | 28 | 10 |
Encrypted Tunnel Exfiltration over TLS. Ignores your network topology entirely and flies straight at the core. | 120 | 1.4 | 2 | 2 | 26 | 12 |
Logic Bomb Dormant until its trigger fires. Hits the core hard, and accelerates the closer it gets to dying. | 180 | 1.6 | 2 | 5 | 30 | 14 |
APT Implant A funded, patient adversary. Shielded, self-healing, and it will outlast anything that cannot burst it down. | 420 | 1.05 | 8 | 4 | 58 | 16 |
Zero-Day Exploit No signature exists. No patch exists. It is immune to throttling and it does not care about your rule sets. | 1700 | 0.75 | 9 | 15 | 420 | — |