Each fiscal year the board grants you two pools of money. The Change budget arrives in four quarterly instalments and buys new security controls and tier upgrades. The Run budget is granted once per year as a single lump and pays the recurring costs of running the programme — staff payroll and tooling licences. Unspent Change banks to a Capital Reserve each quarter; unspent Run banks only at year-end.

Ten threats — malware, ransomware, insider risk, APTs and more — each carry a likelihood and an impact. You counter them by deploying controls from the catalogue, mapped to the NIST functions Identify, Protect, Detect, Respond, Recover. Every control tier shows exactly what it does before you buy. Strong, broad coverage drives your residual risk down toward zero.

Tools do not run themselves. Every control adds operational load to its function; fund staff from the Run budget to keep pace. Understaffed teams run controls at reduced efficacy and lose satisfaction through overwork. You may release roles to cut payroll, but it damages morale. If satisfaction stays critically low for a full year, mass resignations end your tenure.

Each year the board names a crown-jewel priority — a threat they care about most. Every quarter a threat-landscape inject also surges one threat, which often will not match the board's priority. You decide whether to re-allocate Run budget into an emergency control uplift, or ride it out. Threat events strike once a year and disrupt a team for two quarters.

Each quarter: review your risk register and the budget forecast, buy controls, adjust staffing, and respond to any injects. When ready, press Close Quarter / Run Threat Wave. The simulation rolls every threat, applies losses, and reports back. Losses accumulate — cross the board's rising loss tolerance and you are removed as CISO.

You earn a salary plus a performance bonus each year, scaled by board and staff satisfaction, efficiency and incidents — a bad year pays no bonus, a flawless year pays a large one, and strong years raise your base salary. Spend your earnings on personal perks, or invest in a fund that compounds — and sell it later.