GAME MECHANIC

SIGNALS & TECHNICAL // TECHNICAL COLLECTION

Cyber Threat Analyst

Model hostile digital capability, infrastructure, intent, victims, and likely next actions. The persona becomes playable when role, access, loyalty, psychological need, current state, and evidence behavior are tracked independently.

Enter linked operation Decompose this persona

CENTRAL FUNCTION Model hostile digital capability, infrastructure, intent, victims, and likely next actions.

GAME MECHANIC

PERSONA MODEL

How this type makes decisions

Connects indicators into campaigns while guarding against shared infrastructure and planted artifacts.

Decision frame

Signal path, timing, integrity, authorship, collection scope, alternative source, and operational consequence.

Social method

Precise demonstration, controlled tests, technical analogy, and reluctance to overstate attribution.

Gameplay loop

Detect → preserve → isolate → reproduce → attribute cautiously → correlate with human evidence.

Player leverage

Offer an alternative infrastructure explanation or independent campaign link.

Common false read

A technical indicator names the actor; it usually names activity, not ultimate authority.

GAME MECHANIC

TRUST & EVIDENCE

How this persona relates and how this persona knows.

Trust, cooperation, disclosure, evidence quality, and canonical truth are separate systems.

RELATIONSHIP

Trust model

Trusts reproducible technical evidence and longitudinal behavior, not vendor confidence alone.

EVIDENCE

Evidence behavior

Uses hashes, domains, certificates, code traits, access patterns, and victimology.

PLAYER

Useful approach

Offer an alternative infrastructure explanation or independent campaign link.

GAME MECHANIC

PRESSURE TRANSITION

Changed behavior is a clue, not a replacement personality.

Pressure response

Incident pressure encourages premature attribution and tactical tunnel vision.

Breaking condition

Being ordered to keep collecting when intervention could prevent harm.

Recovery path

Scope control, meaningful action, peer verification, and relief from continuous exposure.

GAME MECHANIC

LIKELY STATE PATHS

States modify the active expression of this persona.

A state can narrow choices, change disclosure, or alter evidence conditions while stable identity and values remain available for recovery.

InformationObserving

The persona is withholding commitment while mapping people, exits, contradictions, and incentives.

Player can reveal patterns through patience, but pressure moves the character to Guarded. Open transition record

RelationshipEngaged

The persona is actively cooperating without necessarily granting full trust.

Cooperative actions become available, but secrets still require their own threshold. Open transition record

OperationsActivated

A dormant mission, contingency, loyalty, or protective protocol becomes behaviorally dominant.

The character may become more capable and less socially available; the server’s facts still govern outcomes. Open transition record

StressPressured

Multiple obligations or threats exceed the persona’s ordinary margin.

Errors and revelations become more likely; support can restore options. Open transition record

RecoveryStabilizing

Immediate threat or dysregulation is being reduced enough for choice and orientation to return.

Player gains better evidence by reducing pressure rather than winning an argument. Open transition record

GAME MECHANIC

DIRECT GAME BINDINGS

This type exists because it changes player decisions.

The same persona model is used by character dossiers, operations, evidence, field protocols, and cases.

Character dossiers

Naoko MercerA communications engineer brought in after the east-wing outage. She treats every electronic anomaly as a physical event with an author, a path, and a cost.Kaito RenA communications technician whose stimulant use and prolonged wakefulness turned genuine signal noise and an unauthorized frequency into a personalized instruction stream.Omar al-SayeghA linguist who hears structure in garbled announcements and insists the hospital intercom is carrying a second conversation beneath the first.Amina WardA retired cryptographic archivist with fluctuating attention after infection and medication error. She retains precise fragments of legacy code while sometimes assigning old identities to present staff.

Operations

Signal Seven AlphaA phonetic challenge phrase repeats beneath damaged intercom traffic, but each transmission names a different destination.SIGNAL RESIDUEKaito Ren’s stimulant exposure and prolonged wakefulness turned genuine frequency anomalies into a personalized command stream during a communications outage.Data Core BreachA copied archive accepts valid signatures, rejects original authors, and rewrites the chronology of several operations.

Field methods

SIGINT TriangulationCombine fragmented transmissions, language, timing, channel behavior, and physical evidence.Signal DisciplineUse call signs, challenge phrases, timing, brevity, and read-back to communicate under pressure.Evidence PreservationKeep logs, documents, testimony, and artifacts useful by preserving origin, order, integrity, and uncertainty.

Case files

Signal Seven AlphaA phonetic challenge phrase repeats inside damaged hospital communications.SIGNAL RESIDUE IncidentUnlogged stimulant use, an unsafe staffing chain, genuine frequency anomalies, and a personalized command stream after prolonged wakefulness.Data Core BreachValid signatures attach to the wrong revision lineage and alter operational chronology.

Evidence Lab

Substance, Medication, Sleep, and Signal ResiduePsychosis may arise during intoxication, withdrawal, medication exposure, or prolonged wakefulness. A positive toxicology result is evidence of exposure, not automatic proof of cause.Role, Persona, State, and Allegiance SeparationA job title, operational function, personality pattern, current state, diagnosis, and loyalty answer different questions. This lens prevents one category from silently becoming another.

Jobs and cover access

Cyber Threat Intelligence AnalystCreates a signals & technical gameplay route through access, evidence, relationships, and decisions; the role supplies opportunity but does not determine intent, loyalty, or personality.Defensive Malware AnalystCreates a signals & technical gameplay route through access, evidence, relationships, and decisions; the role supplies opportunity but does not determine intent, loyalty, or personality.Network Defense OperatorCreates a signals & technical gameplay route through access, evidence, relationships, and decisions; the role supplies opportunity but does not determine intent, loyalty, or personality.Science and Technology AnalystCreates a analysis & evidence gameplay route through access, evidence, relationships, and decisions; the role supplies opportunity but does not determine intent, loyalty, or personality.Intellectual Property Protection SpecialistCreates a counterintelligence gameplay route through access, evidence, relationships, and decisions; the role supplies opportunity but does not determine intent, loyalty, or personality.Independent Cyber Threat ResearcherCreates a signals & technical gameplay route through access, evidence, relationships, and decisions; the role supplies opportunity but does not determine intent, loyalty, or personality.Intelligence Applications DeveloperCreates a signals & technical gameplay route through access, evidence, relationships, and decisions; the role supplies opportunity but does not determine intent, loyalty, or personality.

GAME MECHANIC

FULL REPORT DEEP LINKS

The model points back to complete public research sections.

Research grounds the design but does not automatically create game canon. Each link opens the exact report section used to shape this persona family.

Intelligence DisciplinesDefines technical and signals functions. Operational Psychology Without ReductionLinks technical skill to perception and resilience. Counterintelligence: Leads, Hypotheses, and Due ProcessConnects technical capability to cautious attribution and operational consequence.

Source rule: Research ≠ canon
Truth rule: Claim-level
State rule: Reversible where earned
Type rule: Composite