Card Decks

People have asked a number of times about the card decks I use to teach risk models. Below are a few of the cards. I buy them in bulk so I can offer them at a lower price than direct from the printer.


1 - 3: Free

4 - 10: $10

11 - 25: $20

The Balanced Attacker Model (BAM) card deck consists of 10 attackers, 18 assets, the 23 NIST cybersecurity framework categories, and six risk categories.

This deck uses the NIST Critical Infrastructure Framework to address a number of concepts, including:

Threat Modeling

Loss Scenario Iteration

Tradeoff Analysis

Risk Appetite

Resource Scarcity

Risk Management


Layered Defense




Here is the download link to the 11x17 printable tournament placemat, with instructions.


I also offer customized and branded card decks for in-house risk management training.